growi: Unauthenticated guests can modify page drafts via the collaborative editing connection

Impact

The collaborative editing (Yjs) connection authorized users only by checking whether they could view the page, not whether they could edit it. As a result, the following could connect to a page's collaborative editing session and modify its content:

• An unauthenticated guest, on a page that is viewable without logging in (guest access set to "Readonly").
• A logged-in read-only user, on any page the user can view. This applies regardless of the guest access setting, including "Deny".
• A logged-in non-active user (pending approval, suspended, invited) who has view access to the page. This also applies regardless of the guest access setting, including "Deny".

The guest cannot save a revision directly (the page update API correctly rejects them), but the modified content persists as the page's editing draft. When a legitimate user later opens the editor and saves, the injected content is committed to the page history under that user's name. Changes are also visible in real time to other users editing the page.

Disabling user registration does not mitigate this, since the attacker never registers or logs in.

Affected versions

All versions from v7.0.0 up to and including v8.0.6 are affected.

Patches

Fixed in v8.0.7. The collaborative editing connection now applies the same authorization as the page update API (logged-in active user, not read-only) in addition to the page view check.

Workarounds

• Set guest access to "Deny" in /admin/security. This only blocks unauthenticated guests; it does not prevent logged-in read-only users or non-active users with view access from editing.
• Restrict the grant of pages that guests, read-only users, and non-active users can view.

Administrators of affected sites should review editing drafts of publicly viewable pages before they are saved.