GROWI OpenAI thread and message API endpoints lack proper authorization. A logged‑in user who knows the identifier of a shared AI assistant can view or tamper with other users’ threads and messages. This flaw permits unauthorized disclosure and modification of user data, violating confidentiality and integrity, and corresponds to CWE‑862, Authorization Bypass Through User‑Managed Key.

The product impacted is GROWI from GROWI, Inc. The vulnerability affects all releases version 7.4.5 and earlier. No specific patch version is listed in the CVE data. No other products or versions are mentioned.

The CVSS score is 8.7, indicating high severity. The EPSS is below 1%, implying that exploitation is unlikely in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only that the attacker be an authenticated user with knowledge of a shared assistant ID; no elevated privileges or network access are required. The attack vector is through authenticated API access, and the impact includes potential data leakage and tampering.