growchief CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM growchief CVE published 2026-10-14

CVE-2026-110773

CVE-2026-110773 is a missing authorization vulnerability in GrowChief through version 0.3.0, affecting the getAllUsers handler. This allows any authenticated user to list users across all organizations by sending a GET request to the /users/all-users endpoint with an empty or short search value, potentially enumerating user IDs, emails, names, and organization IDs of every tenant.