{"schema":"threatline.record/2","record":{"id":"GHSA-3v2v-8q3r-mhm4","aliases":["GHSA-3v2v-8q3r-mhm4"],"summary":"Unauthenticated guests can modify page drafts via the collaborative editing connection","details":"### Impact\n\nThe collaborative editing (Yjs) connection authorized users only by checking whether they could **view** the page, not whether they could **edit** it. As a result, the following could connect to a page's collaborative editing session and modify its content:\n\n- An unauthenticated guest, on a page that is viewable without logging in (guest access set to \"Readonly\").\n- A logged-in read-only user, on any page the user can view. This applies regardless of the guest access setting, including \"Deny\".\n- A logged-in non-active user (pending approval, suspended, invited) who has view access to the page. This also applies regardless of the guest access setting, including \"Deny\".\n\nThe guest cannot save a revision directly (the page update API correctly rejects them), but the modified content persists as the page's editing draft. When a legitimate user later opens the editor and saves, the injected content is committed to the page history under that user's name. Changes are also visible in real time to other users editing the page.\n\nDisabling user registration does not mitigate this, since the attacker never registers or logs in.\n\n#### Affected versions\n\nAll versions from v7.0.0 up to and including v8.0.6 are affected.\n\n### Patches\n\nFixed in **v8.0.7**. The collaborative editing connection now applies the same authorization as the page update API (logged-in active user, not read-only) in addition to the page view check.\n\n### Workarounds\n\n- Set guest access to \"Deny\" in `/admin/security`. This only blocks unauthenticated guests; it does not prevent logged-in read-only users or non-active users with view access from editing.\n- Restrict the grant of pages that guests, read-only users, and non-active users can view.\n\nAdministrators of affected sites should review editing drafts of publicly viewable pages before they are saved.\n\n","categories":["Unclassified"],"product":"growi","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/growilabs/growi/security/advisories/GHSA-3v2v-8q3r-mhm4","source_modified_at":"2026-10-27T05:18:40Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"other","name":"growi"},"range":">= 7.0.0, <= 8.0.6"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/growilabs/growi/security/advisories/GHSA-3v2v-8q3r-mhm4","source_modified_at":"2026-10-27T05:18:40Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"other","name":"growi"},"version":"8.0.7"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T05:18:39Z","modified_at":"2026-10-27T05:18:40Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/growilabs/growi/security/advisories/GHSA-3v2v-8q3r-mhm4","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-27T05:18:40Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T05:18:40Z","content_hash":"9dc91b97f1000a85389bd27386a4e59003ee7346d178feebae555603b9590f6d"}}