The vulnerability in GROWI version 8.0.2 allows an authenticated user to request attachment metadata through the GET /_api/v3/attachment/:id endpoint without checking whether the user has permission to view the page that contains the attachment. This broken access control permits the attacker to enumerate and retrieve sensitive metadata for attachments located on pages the user otherwise cannot access. The weakness is a classic example of CWE-862, Broken Access Control.

Growi Labs GROWI, version 8.0.2.

The CVSS score of 7.1 indicates a moderate severity level. The exploit requires authentication, meaning the attacker must be a legitimate user with access to the system, but does not need elevated privileges. No publicly available exploit code exists and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is not available, so the likelihood of exploitation in the wild is uncertain. Nevertheless, the ability to disclose metadata could aid further attacks or provide information useful for planning additional exploits, so the issue should be treated as high‑priority for remediation.