GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.

GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/639.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/863.html' target='_blank'></a><ul><li>Authorization bypass through user-controlled key in the bookmark folder APIs (CWE-639) - CVE-2026-53620</li><li>Incorrect authorization in the bookmark listing APIs (CWE-863) - CVE-2026-68951</li></ul>CVE-2026-53620 Masashi Kawamoto reported this vulnerability to JPCERT/CC, and Fumito Otake of The Japan Research Institute, Limited. reported the same vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-68951 GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.