VulnerabilityDeferred

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability.

MEDIUM 6.9EPSS 0.33%

Does this matter?

Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.

Description

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.33% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: vultures@jpcert.or.jp

References

https://growi.co.jp/news/46/
https://jvn.jp/en/jp/JVN42348352/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.