The vulnerability in GROWI arises from improper authorization checks, allowing an unauthenticated attacker to retrieve bookmark data belonging to other users. This data exposure compromises confidentiality, potentially revealing sensitive user preferences or organizational structures. The flaw is classified as an authorization bypass (CWE-863) and does not involve code execution or integrity compromise.

The affected platform is GROWI developed by GROWI, Inc. Version information is not specified in the advisory, indicating that all installations of GROWI that have not applied a patch to this authorization fix remain vulnerable.

The CVSS base score of 6.9 indicates moderate severity. The attack vector is inferred to be remote, as the description mentions an unauthenticated attacker retrieving data, but the specific interface (e.g., web endpoint) is not explicitly stated. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the ability to expose user data without authentication poses a significant privacy risk for environments where GROWI is exposed to external networks.