A flaw in GROWI’s attachment handling bypasses the page‑viewer permission check when a request contains no authenticated user. The route handler returns the attachment file unconditionally if the request is not bound to a valid share link, allowing the attacker to retrieve the file regardless of page privacy settings. This results in unauthorized disclosure of potentially sensitive content and is classified as CWE‑862, a missing authorization weakness.

Any GROWI installation running a version prior to 8.0.2 is vulnerable. The flaw exists in the codebase referenced in the public repository and is fixed in the 8.0.2 release. Administrators should identify instances using GROWI 8.0.1 or earlier and audit the attachments stored therein for exposure risk.

The CVSS score of 8.7 marks the vulnerability as high severity, though the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers only need to know an attachment identifier, which can be obtained if it has ever leaked or was left in a publicly exposed URL, and then issue an unauthenticated HTTP request to /attachment/:id or /download/:id. The path parameter nature of the injection point means the attack is straightforward to execute without additional credentials, making exploitation likely in environments where identifiers are not tightly protected.