CVE-2026-53620 GROWI, Inc. CVE debrief

Who should care

Administrators and users of GROWI installations should be aware of this vulnerability and take necessary actions to secure their systems. This includes reviewing and updating GROWI installations to ensure proper authorization for bookmark folder APIs, implementing additional monitoring for unauthorized access to bookmark data, and verifying user permissions and access controls for bookmark management. Security teams and vulnerability management teams should also be aware of this vulnerability and plan for potential exposures. GROWI users with bookmark data should verify the integrity of their data and report any suspicious activity to their administrators. IT teams responsible for GROWI deployments should prioritize patching or mitigating this vulnerability to prevent potential data breaches. Compliance teams should ensure that GROWI installations are in line with organizational security policies and procedures. Additionally, users of GROWI should be cautious when accessing bookmark data and report any anomalies to their administrators. GROWI administrators should also review user permissions and access controls to prevent unauthorized access to bookmark data. Furthermore, security teams should monitor for potential exploitation attempts and implement compensating controls if necessary. Asset inventory managers should ensure that all GROWI installations are accounted for and prioritized for patching or mitigation. Change management teams should plan for the deployment of patches or mitigations through normal change control processes. Source tracking and monitoring should be implemented to detect potential exploitation attempts. Rollback and change windows should be planned to minimize downtime and ensure business continuity. Compensating controls should be reviewed and implemented if necessary to prevent exploitation. Exposure reviews should be conducted to identify potential vulnerabilities and prioritize remediation efforts. Vendor patch guidance should be followed to ensure that GROWI installations are patched or mitigated properly. Monitoring and detection capabilities should be reviewed and updated to detect potential exploitation attempts. Asset inventory,

Technical summary

The GROWI application contains a vulnerability with an authorization bypass through a user-controlled key in the bookmark folder APIs. This allows an authenticated attacker to retrieve, tamper with, and/or delete the other user's bookmark data. The vulnerability is considered to have a CVSS score of 5.3 and a severity of MEDIUM. Official records from the CVE Program and NVD provide details on the vulnerability.

Defensive priority

Authenticated attackers could exploit this vulnerability to access, modify, or delete bookmark data of other users.

Recommended defensive actions

• Review and update GROWI installations to ensure proper authorization for bookmark folder APIs.
• Implement additional monitoring for unauthorized access to bookmark data.
• Verify user permissions and access controls for bookmark management.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Conduct an exposure review to identify potential vulnerabilities and prioritize remediation efforts.
• Plan for the deployment of patches or mitigations through normal change control processes.
• Monitor for potential exploitation attempts and implement source tracking and monitoring.

Evidence notes

The CVE-2026-53620 record indicates a vulnerability in GROWI, specifically an authorization bypass through a user-controlled key in the bookmark folder APIs. Official records from the CVE Program and NVD provide details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.