Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Growi | Weseek | 4.0.0 (including) | 4.5.25 (excluding) |
| Growi | Weseek | 5.0.0 (including) | 5.1.4 (excluding) |