The vulnerability allows an authenticated attacker to bypass authorization controls in the page viewing and commenting features, enabling retrieval of page contents and comments that should be protected by read permissions. This bypass is based on improper handling of a user-controlled key, resulting in unauthorized read access to sensitive data.

The affected product is GROWI from GROWI, Inc. No version information was supplied, so the vulnerability applies to all releases of GROWI that contain the identified code paths.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score was not reported, implying low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. In practice, only an authenticated user lacking the necessary read permission can exploit the flaw, meaning that the attack requires prior authentication and does not allow arbitrary code execution.