Is CVE-2026-84204 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84204?

CVE-2026-84204 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-84204

Description

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.