A missing authorization vulnerability in GROWI versions 7.4.5 and earlier allows authenticated users to access and manipulate sensitive AI-driven communication threads belonging to other users.

This is a missing authorization flaw (CWE-862) located within the OpenAI thread and message API endpoints. Any authenticated user who identifies a shared AI assistant identifier can unauthorizedly view or tamper with the threads and messages of other users.

The ability for unauthorized users to access and modify private AI communication threads poses a significant risk to data confidentiality and integrity. Given the CVSS score of 8.3, this high-severity vulnerability could lead to the exposure of sensitive organizational information or the corruption of collaborative data, necessitating prompt intervention to prevent unauthorized data access.

Immediate Action: Review the official GROWI vendor advisory for the release of a security patch and update all instances to the latest version as soon as it becomes available.

Proactive Monitoring: Audit access logs for the OpenAI API endpoints to identify unusual patterns, such as multiple access attempts to thread identifiers not associated with the authenticated user account.

Compensating Controls: Restrict access to the GROWI application to trusted network segments and implement strict API gateway controls to validate user permissions before requests reach the application backend.

Public Exploit Available: No — exploit_available (unknown).

The risk associated with this vulnerability is high due to the potential for unauthorized access to sensitive AI-generated content. Administrators should prioritize monitoring their GROWI installations for signs of unauthorized API access and must apply the vendor-provided patch immediately upon its release to secure the integrity of their collaborative environment.