{"schema":"threatline.record/2","record":{"id":"CVE-2026-105272","aliases":["GHSA-m72c-xgjf-56ww"],"summary":"GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated a","details":"GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.","categories":["Unclassified"],"product":"GROWI","vendor":"GROWI, Inc.","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105272","source_modified_at":"2026-10-28T02:21:24.458Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"GROWI","vendor":"GROWI, Inc.","versions":[{"version":"v3.2.10","status":"affected","versionType":"semver","lessThanOrEqual":"v8.0.6"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.2,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T02:21:24.458Z","modified_at":"2026-10-28T02:21:24.458Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105272","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T02:21:24.458Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/growilabs/growi/security/advisories/GHSA-m72c-xgjf-56ww"},{"source":"CVE List","url":"https://growi.co.jp/news/48/"},{"source":"CVE List","url":"https://jvn.jp/en/jp/JVN51223238/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T02:21:24.458Z","content_hash":"98f95c20e2b873b5c572212d5381f67ab5b1d87e484a29091e47fae85deac6da"}}