CVE-2026-53620: GROWI Authorization Bypass Vulnerability

CVE-2026-53620 Overview

CVE-2026-53620 is an authorization bypass vulnerability in GROWI, an open-source wiki platform. The flaw resides in the bookmark folder APIs, which trust a user-controlled key when accessing bookmark resources. An authenticated attacker can supply another user's identifier to retrieve, modify, or delete bookmark data belonging to that user. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, also known as Insecure Direct Object Reference (IDOR). Exploitation requires only low-privileged authentication and no user interaction.

Critical Impact
Authenticated attackers can access and manipulate other users' bookmark folder data through the affected GROWI APIs, breaking multi-tenant confidentiality and integrity boundaries.

Affected Products

GROWI (open-source collaborative wiki by WESEEK, Inc.)
Bookmark folder API endpoints in affected GROWI releases
Refer to the GROWI news update and JVN advisory JVN#42348352 for exact affected version ranges

Discovery Timeline

2026-08-31 - CVE-2026-53620 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-53620

Vulnerability Analysis

GROWI exposes REST APIs that manage bookmark folders and their contents on a per-user basis. The affected endpoints accept a resource identifier from the client request and use it directly to look up bookmark data. The server fails to verify that the authenticated session owns the referenced bookmark folder. This missing ownership check allows any logged-in user to substitute another user's identifier and operate on that user's records. The result is a horizontal privilege escalation across user accounts within the same GROWI instance.

Root Cause

The root cause is a missing authorization check between authentication and data access, tracked as CWE-639. The bookmark folder APIs authenticate the caller but do not validate that the caller is the owner of the target bookmark resource. Because the resource key is user-controlled and unauthenticated at the object level, standard IDOR conditions apply.

Attack Vector

An attacker must first authenticate to the target GROWI instance with any valid low-privileged account. The attacker then issues API requests to the bookmark folder endpoints, replacing the resource identifier with one belonging to another user. The server returns, updates, or deletes the referenced data without checking ownership. No social engineering or user interaction is required, and the attack is executable remotely over the network.

No public proof-of-concept code has been released. Refer to the JVN advisory for coordinated disclosure details.

Detection Methods for CVE-2026-53620

Indicators of Compromise

Unexpected read, update, or delete operations against bookmark folder API paths from accounts that do not own the referenced resource
HTTP request logs showing a single authenticated session iterating through sequential or foreign user or folder identifiers
Bookmark records disappearing, being renamed, or being modified without corresponding activity from the owning user

Detection Strategies

Correlate the authenticated session identifier in GROWI application logs with the target resource owner to detect cross-user access attempts
Alert on high-volume enumeration patterns against bookmark folder endpoints from a single account within a short time window
Baseline normal per-user API call patterns and flag deviations that indicate resource identifier tampering

Monitoring Recommendations

Forward GROWI application and reverse-proxy access logs to a centralized analytics platform for correlation and long-term retention
Monitor for 4xx and 2xx responses on bookmark folder endpoints where the requesting user differs from the resource owner
Track administrative audit events for unexpected changes to user bookmark data and review them during incident response

How to Mitigate CVE-2026-53620

Immediate Actions Required

Upgrade GROWI to the fixed release listed in the GROWI news update and the JVN advisory
Inventory all GROWI deployments, including internal wikis and staging instances, and confirm versions against the vendor advisory
Review authentication logs for unusual API activity against bookmark folder endpoints prior to patching

Patch Information

WESEEK, Inc. has released fixed versions of GROWI that address the missing ownership check in the bookmark folder APIs. Consult the official GROWI advisory for the exact patched version numbers and upgrade instructions. Apply the update on all production and non-production instances.

Workarounds

Restrict network access to GROWI instances to trusted users and internal networks until the patch is applied
Reduce the number of authenticated accounts on the platform and disable self-registration where feasible
Where possible, place the affected bookmark folder API paths behind a reverse-proxy access control list that limits usage to known administrators until upgrade is complete