GROWI contains an authorization bypass that occurs when a user supplies a key controlled by themselves in the bookmark folder APIs. The flaw allows an authenticated attacker to view, modify, or delete bookmark data belonging to other users, resulting in unauthorized disclosure, alteration, or denial of that data. The vulnerability directly compromises the integrity and confidentiality of user bookmark information within the application and is classified as CWE‑639, an authorization bypass due to improper validation of user‑supplied keys.

The vulnerability affects the GROWI product developed by GROWI, Inc. No specific product versions are listed in the data, so the exposure is presumed to cover all released builds until a fix is applied.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with legitimate access to the GROWI instance; the attacker can then craft API requests that include a key belonging to a target user, bypassing authorization checks. The likely attack vector is the application‑level bookmark folder API over HTTP/HTTPS, and deployment exposure is limited to the scope of the specific GROWI installation. The risk is elevated for environments with open or internet‑exposed GROWI instances where users have broad access and bookmark data is considered sensitive.