CVE-2026-84205
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
- Published Sep 1, 2026
- CVSS 7.1 high
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available