GROWI contains an authorization bypass flaw in its tag update and page update APIs. The vulnerability stems from the improper handling of a user‑controlled key, allowing an authenticated attacker to override permission checks. As a result, a user who can log in can read page content they should not have access to and can also write changes to pages that they normally cannot edit.

The affected product is GROWI by GROWI, Inc. No specific version information is provided in the advisory.

The CVSS score is 2.3, indicating a low severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires legitimate user credentials, so the attack vector is likely authenticated. The flaw enables privilege escalation as defined by CWE‑639, permitting unauthorized read and write access to content within the application.