CVE-2021-3852

growi is vulnerable to Authorization Bypass Through User-Controlled Key

• CWE-639

• https://github.com/weseek/growi/commit/863bfd7f622f413bd159b9446166fb1ce78ec863Patch, Third Party Advisory
• https://huntr.dev/bounties/d44def81-2834-4031-9037-e923975c3852Exploit, Third Party Advisory
• https://github.com/weseek/growi/commit/863bfd7f622f413bd159b9446166fb1ce78ec863Patch, Third Party Advisory
• https://huntr.dev/bounties/d44def81-2834-4031-9037-e923975c3852Exploit, Third Party Advisory

Published

Jan 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38514Certain NETGEAR devices are affected by authentication bypas…2.7
• CVE-2021-38515Certain NETGEAR devices are affected by denial of service. T…7.5
• CVE-2021-38516Certain NETGEAR devices are affected by lack of access contr…9.8
• CVE-2021-38517Certain NETGEAR devices are affected by out-of-bounds reads …7.2
• CVE-2021-38518Certain NETGEAR devices are affected by command injection by…7.2
• CVE-2021-38519Certain NETGEAR devices are affected by command injection by…7.2
• CVE-2021-38520Certain NETGEAR devices are affected by command injection by…7.2
• CVE-2021-38521Certain NETGEAR devices are affected by command injection by…7.2
• CVE-2021-38522NETGEAR R6400 devices before 1.0.1.52 are affected by a stac…7.2
• CVE-2021-38523NETGEAR R6400 devices before 1.0.1.70 are affected by a stac…7.2
• CVE-2021-38524Certain NETGEAR devices are affected by a stack-based buffer…4.9
• CVE-2021-38525Certain NETGEAR devices are affected by a stack-based buffer…7.2