Threat-modeling wiki confidentiality after GROWI CVE-2026-105272
Overview
A wiki permission model often assumes that each revision inherits the page's access boundary. CVE-2026-105272 broke that assumption in GROWI. A page could authorize a request while its revision came from another page. The result was an authenticated read bypass for bodies and comments.
JVN records CWE-639, CVSS 4.0 2.3, and CVSS 3.0 4.2. The affected versions are v3.2.10 through v8.0.6, and the fix is v8.0.7.
Mechanism and exploitation conditions
Several handlers received pageId and revisionId. The access check covered the page. It did not prove that the revision belonged to the page. A logged-in user could combine a viewable page ID with a foreign revision ID. The response could reveal the foreign body. The comment route had the same flaw and could return comments and creator details.
The user needed a valid account and knowledge of the target revision ID. GROWI's MongoDB ObjectIds include time, per-process randomness, and a counter. They are not secret tokens. A user can create revisions and observe the pattern. Edit permission was not required.
Impact
This is a confidentiality threat across page boundaries. The affected assets are restricted bodies, discussions, and related metadata. The actors are authenticated users who might otherwise have limited page access. The precondition is access to a revision identifier and a viewable page from which to submit the mixed request.
The maintainer states that the read creates no revision and leaves no trace in that workflow. The review did not identify an in-the-wild exploitation report. The flaw alone does not provide server execution.
Affected products and scope
GROWI v3.2.10 through v8.0.6 is affected. The page-body path has existed since v3.3.0, and the comment endpoint accepted a revision ID from at least v3.2.10. Share-link access was not affected.
Exposure context
ZoomEye returned 401 product-title matches for GROWI on 2026-11-15. The exact CVE Filter returned zero. Product title exposure identifies candidates, not vulnerable systems. A threat model should assign confidence separately for product presence, version, account reachability, and evidence of a request.
Remediation and mitigations
GROWI v8.0.7 verifies that a client-supplied revision belongs to the page. If it does not, reads fall back to the page's own latest revision or comments. Comment write operations reject a foreign revision. The advisory contains no workaround.
Upgrade to v8.0.7 or later. Then assess whether page permissions match the confidentiality level of stored content, whether all accounts still need access, and whether application logs can answer the questions the advisory leaves unresolved. Do not infer safety from the CVSS score alone.
