CVE-2025-67844
Last modified
CVE-2025-67844 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mintlify | Mintlify | < 2025-11-15 |
References
- https://kibty.town/blog/mintlify/Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=46317098Issue Tracking
- https://www.mintlify.com/docs/changelogRelease Notes
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-67844?
How severe is CVE-2025-67844?
How do I fix CVE-2025-67844?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-67835Paessler PRTG Network Monitor before 25.4.114 allows Denial-…6.5
- CVE-2025-6784The Code Engine plugin for WordPress is vulnerable to Remote…8.8
- CVE-2025-67840Multiple authenticated OS command injection vulnerabilities …7.2
- CVE-2025-67841Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+…7.5
- CVE-2025-67842The Static Asset API in Mintlify Platform before 2025-11-15 …5.4
- CVE-2025-67843A Server-Side Template Injection (SSTI) vulnerability in the…9.8
- CVE-2025-67845A Directory Traversal vulnerability in the Static Asset Prox…5.4
- CVE-2025-67846The Deployment Infrastructure in Mintlify Platform before 20…6.5
- CVE-2025-67847A flaw was found in Moodle. An attacker with access to the r…8.8
- CVE-2025-67848A flaw was found in Moodle. This authentication bypass vulne…8.1
- CVE-2025-67849A flaw was found in Moodle. This cross-site scripting (XSS) …6.1
- CVE-2025-6785Securing externally available CAN wires can easily allow phy…4.7
Are you affected by CVE-2025-67844?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST