Regression tests for GROWI-style revision authorization

Overview

CVE-2026-105272 came from two IDs that looked related to the application but were not proven related to each other. GROWI authorized a page ID, then accepted a revision ID from a different page. The fix in v8.0.7 turns that relationship into an explicit condition.

A useful regression suite should test mixed ownership, not only valid and invalid sessions. The security property is that every request binds a child object to the same parent used for authorization. JVN lists the affected range as GROWI v3.2.10 through v8.0.6 and assigns CVSS 4.0 2.3 and CVSS 3.0 4.2 scores.

Mechanism and exploitation conditions

The vulnerable read paths accepted pageId and revisionId. Authorization checked the page. The revision was fetched without confirming that it belonged to that page. A logged-in user could combine a viewable page with a foreign revision and receive the foreign body. The comment endpoint could return foreign comments. Comment create and update paths accepted foreign revisions for linking.

The attacker needed a valid login and a target revision ID. MongoDB ObjectId values contain time, process randomness, and a counter. They are not secret by design. A user can create revisions and observe their shape. The page route did not require edit permission. Share-link access was not affected.

Impact

A missing test for object ownership can expose restricted page bodies, comments, and creator information. The maintainer says the page read creates no revision and leaves no trace in that path. No reviewed source reports exploitation in the wild. The issue is a confidentiality bypass with a limited comment-linking integrity problem.

Affected products and scope

JVN lists GROWI v3.2.10 through v8.0.6. The page-body path has been present since v3.3.0, and the comment endpoint accepted revision IDs from at least v3.2.10. The fixed release is v8.0.7.

Exposure context

ZoomEye returned 401 product-title matches for GROWI on 2026-11-15. The exact vul.cve="CVE-2026-105272" Filter returned zero. These results are inventory evidence only. Version and route testing are still required.

Remediation and mitigations

GROWI v8.0.7 checks that a supplied revision belongs to the page. Page-body and comment reads fall back to the page's own latest revision or comments when ownership fails. Comment writes reject the foreign revision. The advisory lists no workaround.

A regression test based on the advisory should cover a page and revision owned by the caller, a revision that exists on another page, and a revision ID that does not exist. The first should render the expected page data. The second and third should not disclose the foreign body or comments and should follow the same fallback path. Repeat for comment reads and for comment create and update operations. Check a read-only account and share-link behavior as separate cases. Do not assert that an empty application log proves no read occurred.

References

• JVN#51223238
• GROWI advisory GHSA-m72c-xgjf-56ww
• GROWI v8.0.7 release
• OSV CVE-2026-105272