CVE-2026-80191 | CVSS: 7.5 | 严重级别: HIGH
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is
参考链接:
• https://github.com/growilabs/growi
• https://github.com/growilabs/growi/blob/v8.0.1/apps/app/src/server/routes/attach
• https://github.com/growilabs/growi/pull/11756
📌 数据来源: NVD 官方