Published:2026/08/28  Last Updated:2026/08/28

JVN#42348352
Multiple vulnerabilities in GROWI

Overview

GROWI provided by GROWI, Inc. contains multiple vulnerabilities.

Products Affected

  • GROWI v8.0.0 and earlier

Description

GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below:

  • Authorization bypass through user-controlled key in the bookmark folder APIs (CWE-639)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N Base Score 5.3
    • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Base Score 6.3
    • CVE-2026-53620
  • Incorrect authorization in the bookmark listing APIs (CWE-863)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 6.9
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score 5.3
    • CVE-2026-68951

Impact

  • An authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data (CVE-2026-53620).
  • An unauthenticated attacker could retrieve the other user's bookmark data (CVE-2026-68951).

Solution

Update the Software
Update the software to the latest version. The developer has released the following version to address these vulnerabilities.

  • GROWI v8.0.1

Vendor Status

Vendor Status Last Update Vendor Notes
GROWI, Inc. Vulnerable 2026/08/28 GROWI, Inc. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

CVE-2026-53620
Masashi Kawamoto reported this vulnerability to JPCERT/CC, and Fumito Otake of The Japan Research Institute, Limited. reported the same vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2026-68951
GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-53620
CVE-2026-68951
JVN iPedia JVNDB-2026-000089