CVE-2026-115624 Details

A vulnerability allowing unauthorized modifications of page drafts has been identified in GROWI versions 7.0.0 through 8.0.6. This issue arises from a missing authorization check in the collaborative editing feature, which is based on Yjs. The vulnerability allows users with read-only permissions, including guest users, as well as users with pending, suspended, or invited statuses, to alter page drafts. Although these users cannot directly save the changes, the modifications remain in the editing draft. When a legitimate user later opens the editor and saves, the changes are committed to the page history under the user's name, with real-time visibility to others editing the page.

Users are advised to update GROWI to version 8.0.7 or later, where this vulnerability has been fixed. For those unable to update immediately, guest access can be set to 'Deny' to prevent unauthenticated users from making changes. However, this does not block logged-in read-only users or non-active users with view access from editing. Administrators should review editing drafts of publicly viewable pages before they are saved.