The vulnerability is caused by the API at /_api/v3/revisions/:id accepting a page identifier in the query string and a revision identifier in the path separately. Authorization is only verified against the query parameter, while the revision is retrieved solely by the path value. An attacker who owns a valid credential for any page can pair that page's identifier with the identifier of a revision belonging to a different page, thereby reading content that should be restricted. This exposes the revision history of protected pages and can leak confidential or sensitive information. The weakness is an instance of an insecure direct object reference (CWE‑639).

The flaw resides in GrowiLabs' GROWI content management system, affecting all releases through version 8.0.2. The API endpoint is exploitable when the system is reachable and the user has authenticated access to at least one page.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is not available, so no concrete probability is listed, and the vulnerability is not in the CISA KEV catalog. The attack is fully remote; an authenticated user can invoke the endpoint from any networked device that can reach the GROWI instance. Because the flaw simply requires passing two identifiers, exploitation is straightforward once the attacker has a valid session cookie or API token. The absence of server‑side binding between the two identifiers makes the risk significant for any organization hosting a publicly accessible GROWI installation.