GROWI Missing Authorization Vulnerability in OpenAI API Endpoints Allowing Unauthorized Access to Threads and Messages

A vulnerability exists in GROWI versions through 7.4.5, where the OpenAI thread and message API endpoints lack proper authorization. This flaw allows logged-in users to access and manipulate threads and messages of other users, provided they know the identifier of a shared AI assistant.

Impact

Exploitation of this vulnerability enables a logged-in user to view and modify another user's threads and messages within the application.

Remediation

Users are advised to update GROWI to version 7.4.6 or later. The updated version can be downloaded from GitHub or Docker Hub.