CyberRota Analysis
AI-GeneratedGROWI has an access control vulnerability in the GET /_api/v3/revisions/:id endpoint, allowing authenticated attackers to exploit mismatched page and revision identifiers. This could enable unauthorized access to sensitive revision content from pages that the attacker should not be able to view. Organizations using GROWI should prioritize addressing this vulnerability to prevent potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.