PT-2026-25629 · Growi · Growi

Sho Odagiri · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-25083

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions GROWI versions prior to 7.4.5

Description The GROWI OpenAI thread/message API endpoints do not perform proper authorization checks. A logged-in user who has access to a shared AI assistant's identifier can potentially view and modify other users' threads and messages. The affected API endpoints allow unauthorized access to sensitive data and potential tampering with user communications.

Recommendations Versions prior to 7.4.5 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25083

Affected Products

Growi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25083 · Security Note
• https://growi.co.jp/news/41 · Note
• https://t.me/CVEtracker/47508 · Telegram Post
• https://jvn.jp/en/jp/JVN46373837 · Note
• https://twitter.com/infoflowcloud/status/2033585732976046232 · Twitter Post
• https://twitter.com/CVEnew/status/2033583701238681873 · Twitter Post