The vulnerability exists in GROWI’s collaborative editing feature, where an inadequate authorization check allows users who normally only have read permissions—including guests, pending, suspended, or invited users—to modify draft pages. This results in integrity compromise, permitting unauthorized changes to content before publication without altering the system’s overall security posture.

The affected product is GROWI from GROWI, Inc. No specific version information is provided in the advisory.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, making the exact likelihood uncertain, and the entry is not listed in the CISA KEV catalog. Exploitation appears straightforward: a user with read‑only access can employ the web interface’s collaborative editing function to rewrite drafts. The lack of a restriction on draft modification suggests that any authenticated user in the specified states can abuse the feature, raising the risk of undetected content changes.