CVE-2026-68951: GROWI Authorization Bypass Vulnerability

CVE-2026-68951 Overview

CVE-2026-68951 is an incorrect authorization vulnerability in GROWI, an open-source wiki platform developed by WESEEK, Inc. The flaw allows an unauthenticated remote attacker to retrieve bookmark data belonging to other users. The issue is classified under CWE-863: Incorrect Authorization and reflects a missing access-control check on an endpoint that returns user-specific data.

Critical Impact
An unauthenticated attacker can retrieve other users' bookmark data over the network with low attack complexity and no user interaction.

Affected Products

GROWI (WESEEK, Inc.)
Specific affected versions are listed in the JVN Security Bulletin #42348352
Refer to the GROWI News Update for the fixed release

Discovery Timeline

2026-08-31 - CVE-2026-68951 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-68951

Vulnerability Analysis

GROWI exposes a network-accessible endpoint that returns bookmark data associated with user accounts. The vulnerable endpoint does not enforce an authorization check confirming that the requesting principal owns, or is permitted to view, the requested bookmark records. As a result, an unauthenticated caller can request bookmark data belonging to arbitrary users.

The defect affects confidentiality only. Bookmark entries in GROWI typically reference internal wiki pages, which may reveal project structure, sensitive page titles, or non-public URLs. The vulnerability does not permit modification of data or disruption of service.

Exploitation requires no privileges, no user interaction, and no special environmental preconditions. The attacker interacts with the exposed HTTP API directly.

Root Cause

The root cause is a missing or improperly implemented authorization decision on the bookmark retrieval path. The application authenticates or accepts the request but fails to bind the returned data to the caller's identity, matching the pattern described in CWE-863.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the GROWI application targeting the bookmark data endpoint and specifying user identifiers or bookmark identifiers belonging to other accounts. The server returns the requested records without validating ownership.

No verified public proof-of-concept exploit is available at the time of publication. Refer to the JVN Security Bulletin #42348352 for vendor-supplied technical details.

Detection Methods for CVE-2026-68951

Indicators of Compromise

Unauthenticated HTTP requests to GROWI bookmark-related API endpoints originating from unexpected source addresses
Enumeration patterns iterating over sequential user identifiers or bookmark identifiers in request parameters
Anomalous response volumes returning bookmark records to sessions without an authenticated user context

Detection Strategies

Inspect GROWI application logs for bookmark endpoint access without an associated authenticated session identifier
Deploy web application firewall (WAF) rules that flag identifier enumeration and high-rate access to user data endpoints
Correlate HTTP access logs with authentication logs to surface requests that read user-scoped data without prior login events

Monitoring Recommendations

Forward GROWI access and application logs to a centralized log platform for retention and search
Alert on spikes in 4xx/2xx response ratios on bookmark endpoints, which can indicate scripted enumeration
Monitor outbound egress from the GROWI host for unexpected large data transfers following API traffic

How to Mitigate CVE-2026-68951

Immediate Actions Required

Upgrade GROWI to the fixed version identified in the GROWI News Update
Restrict network exposure of GROWI instances to trusted networks or place them behind a reverse proxy that enforces authentication
Review application logs for prior unauthorized access to bookmark data and notify affected users where evidence exists

Patch Information

WESEEK, Inc. has published fix information for GROWI. Administrators should consult the GROWI News Update and the JVN Security Bulletin #42348352 to identify the patched release and apply it according to the project's upgrade guidance.

Workarounds

Place the GROWI instance behind a reverse proxy or VPN that requires authentication before reaching the application
Apply network-level access controls to limit reachability of the bookmark API to authenticated internal users
Enable request-rate limiting on GROWI endpoints to slow enumeration attempts until the patch is deployed