Description

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T16:17:34.747Z",
  "pubdate": "2026-09-01T16:17:34.747Z",
  "executiveSummary": "GROWI, an open-source wiki and knowledge sharing platform, contains an access control vulnerability within its API routing architecture. Specifically, the security flaw resides in the authorization logic governing the 'GET /_api/v3/attachment/:id' endpoint. This vulnerability constitutes a Broken Object Level Authorization (BOLA) issue, where the application fails to properly validate the requesting user's authorization against the access permissions of the parent page hosting the attachment.\nAn authenticated attacker can exploit this weakness to bypass logical organizational boundaries. By supplying known attachment identifiers directly to the vulnerable API endpoint, the attacker can successfully retrieve metadata associated with attachments hosted on restricted pages that they are otherwise unauthorized to view. This information disclosure compromises the confidentiality of metadata, potentially revealing sensitive file names, creation dates, upload paths, and administrative ownership details. Consequently, the organization's overall security posture is weakened, as this leaked metadata can be leveraged to map out internal documentation structures or facilitate subsequent, more targeted social engineering and technical attacks against the enterprise network. No administrative privileges are required for exploitation, making any standard authenticated user a potential threat vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the access control verification layer of the GROWI application, specifically within the controller logic handling the 'GET /_api/v3/attachment/:id' API endpoint. In a secure implementation, when a client requests access to a page attachment, the backend application must perform a dual-layered validation check: first, validating the authentication status of the requester, and second, ensuring that the user possesses sufficient read permissions for the specific parent page to which the attachment object is bound. However, the 'GET /_api/v3/attachment/:id' endpoint omits this critical secondary check. While it successfully verifies that the request originates from an authenticated session, it fails to evaluate the relationship between the attachment's parent page access control lists (ACLs) and the requester's access rights.\nThe attack flow is straightforward and requires minimal complexity. To initiate the exploit, an attacker must first establish an authenticated session with the target GROWI instance. No elevated privileges are necessary. The attacker then identifies or predicts a target attachment identifier (represented as the ':id' parameter). Using a command-line HTTP client (such as curl) or an API testing utility, the attacker constructs and transmits an HTTP GET request to the path '/_api/v3/attachment/[target_id]'. Because the backend database query retrieves the attachment record using only the provided identifier, without performing an intersection join or a sub-query validation against the parent page's permission schema, the application processes the request as valid.\nThe resulting response payload contains structured JSON data depicting the metadata of the requested attachment. Although the vulnerability does not directly expose the raw binary file content of the attachment via this specific endpoint, the metadata disclosure represents a significant security breach. The returned metadata typically includes fields such as file names, MIME types, file sizes, creation and modification timestamps, reference IDs to parent documents, and uploader accounts. Armed with this information, an attacker can systematically brute-force or enumerate attachment identifiers to construct a conceptual map of the organization's restricted documentation, target intellectual property disclosed in filenames, and harvest administrative usernames for subsequent vectors of compromise."
}