Is CVE-2026-80191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80191 being exploited in the wild.

How severe is CVE-2026-80191?

High severity, with a CVSS score of 7.5, published 26 August 2026.

Is there a fix for CVE-2026-80191?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80191 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80191?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80191: GROWI authorization bypass in attachment retrieval

CVE-2026-80191 · Severity: high · CVSS 7.5 · Published 2026-08-26

GROWI is a team collaboration platform that allows users to create and share markdown pages with access controls. An unauthenticated attacker who knows the identifier of a private attachment can bypass the permission system and download the file without authentication, even if the page is marked private and they would not normally have access. This allows sensitive documents and files to be exposed if their identifiers are leaked or guessed.

Quick answers

Is CVE-2026-80191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80191 being exploited in the wild.
How severe is CVE-2026-80191?: High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?: GROWI GROWI before 8.0.2.
Is there a fix for CVE-2026-80191?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80191 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80191?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the attachment download functionality. The retrieveAttachmentFromIdParam function in apps/app/src/server/routes/attachment/get.ts guards permission checks with a condition that requires an authenticated user (non-null user), causing unauthenticated requests to skip the check entirely. The routes /attachment/:id and /download/:id take the attachment identifier from the URL path and return the file without verifying page-viewer permissions for requests without a session. An unauthenticated attacker can retrieve any attachment file if they possess or can guess its identifier, regardless of whether the containing page is private or marked for restricted access. The vulnerability was fixed in version 8.0.2, which applies the permission check to both authenticated and unauthenticated requests.

Affected products

GROWI GROWI before 8.0.2

Timeline

2026-08-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.