{"data":{"id":"61ac069f-1bb8-439c-b6f4-d521c2b41f16","title":"CVE-2026-25083: GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A…","summary":"CVE-2026-25083 affects GROWI's OpenAI thread/message API endpoints, which do not perform authorization in v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper with another user's threads and messages. The weakness is classified as CWE-862 (Missing Authorization) and JPCERT/CC scored it CVSS-B 8.7 HIGH (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25083","publishedAt":"2026-03-16T14:18:18.177Z","cveId":"CVE-2026-25083","cweIds":["CWE-862"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["GROWI OpenAI thread/message API","GROWI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GROWI OpenAI thread and message API endpoints lack authorization checks","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0032,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-c69x-9x9c-p9v7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:11:00.446Z","patchAvailable":null,"disclosureDate":"2026-03-16T14:18:18.177Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}