Information from GROWI, Inc.

[Summary]
GROWI, developed by GROWI, Inc., has been found to contain multiple vulnerabilities
in its bookmark and bookmark folder features: an IDOR (Insecure Direct Object
Reference) vulnerability in the bookmark folder APIs, and an improper access control
vulnerability in the bookmark listing APIs.

[Affected Products]
These vulnerabilities affect GROWI v8.0.0 and earlier.

[Description]
GROWI v8.0.0 and earlier contain the following vulnerabilities.

1. IDOR in the bookmark folder APIs
Multiple bookmark folder endpoints did not verify that the target bookmark folder
belongs to the requesting user, allowing an authenticated user to operate on other
users' bookmark folders:
- The bookmark folder deletion API allowed deleting other users' bookmark folders.
- The bookmark folder update API allowed renaming other users' bookmark folders,
and moving bookmark folders into another user's bookmark folder hierarchy.
- The bookmark folder creation API allowed creating a bookmark folder under
another user's bookmark folder.
- The API that adds a bookmark to a bookmark folder allowed adding bookmarks into
another user's bookmark folder.

2. Improper access control in the bookmark listing APIs
The APIs that return a specified user's bookmarks returned information about the
bookmarked pages without applying page-level view permissions or the
administrator's page list display settings. As a result, an authenticated user
could obtain information about pages they are not permitted to view by requesting
another user's bookmark list.
In addition, this API can be called by unauthenticated guest users when the
instance is configured to allow guests to read. Therefore a guest user can view
another user's profile page and see that user's bookmarks pointing to pages the
guest is not permitted to view.

[Impact]
A logged-in general user may perform the following operations:
- Completely delete other users' bookmark folders, including child bookmark folders
and bookmarks.
- Rename other users' bookmark folders, and alter their structure by moving bookmark
folders.
- Create bookmark folders under other users' bookmark folders, and add bookmarks to
them.
- By automating the attack, an attacker can bulk-delete or bulk-manipulate bookmark
folders and bookmark data across all users.
- Obtain information (such as page paths and titles) about pages they are not
authorized to view — including pages restricted to specific users or user groups,
pages published as "Anyone with the link", and user pages while user pages are
disabled — through other users' bookmark lists.

When the instance is configured to allow guests to read, an unauthenticated guest
user may also perform the following operation:
- View another user's profile page and obtain information about pages the guest is
not authorized to view, from that user's bookmarks.

[Solution]
Please upgrade your GROWI to v8.0.1 or later.

### Where to get the updated version
- [GitHub](https://github.com/growilabs/growi)
- [Docker Hub](https://hub.docker.com/r/growilabs/growi)