GrowChief versions up to 0.3.0 contain a missing authorization flaw in the getAllUsers handler; this allows any authenticated user to call the /users/all-users endpoint and retrieve names, email addresses, user identifiers and organization identifiers for every tenant. The vulnerability enables cross‑tenant data leakage without providing any privilege escalation or direct system compromise.

The product GrowChief, distributed by the vendor growchief, is affected for all releases through version 0.3.0. Based on the description, it is inferred that versions with the IsSuperAdmin guard, such as 0.3.1 and later, are not impacted.

The CVSS score of 5.3 indicates medium severity while the EPSS score of less than 1% reflects a low likelihood of exploitation. GrowChief is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers only need an authenticated session, which can be obtained by registering a low‑privilege account, to exploit the flaw via an HTTP or HTTPS GET request to the endpoint. The risk is primarily privacy and cross‑tenant disclosure rather than full system compromise.