CVE-2025-67844: Medium severity Mintlify Mintlify Platform vulnerability
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67844?
CVE-2025-67844 is classified as a medium severity vulnerability due to its potential for exposing sensitive repository metadata.
How do I fix CVE-2025-67844?
To fix CVE-2025-67844, update the Mintlify Platform to version 2025-11-15 or later.
What types of attacks are possible with CVE-2025-67844?
CVE-2025-67844 allows remote attackers to conduct unauthorized access to repository metadata, potentially leading to information disclosure.
Which versions of Mintlify Platform are affected by CVE-2025-67844?
CVE-2025-67844 affects all versions of Mintlify Platform prior to 2025-11-15.
What is the root cause of CVE-2025-67844?
The root cause of CVE-2025-67844 is the failure to validate repository owner and name fields during the configuration of the GitHub Integration API.