PatchTheCVECVE-2025-67844: The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive
CVE-2025-67844 is a medium-severity flaw (CVSS 5.0) affecting mintlify. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-425 |
| Published | 2025-12-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-67844?
mintlify: upgrade to 2025-11-15. Exact commands for each OS are on this page.
Is CVE-2025-67844 being exploited?
CVE-2025-67844 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-67844 affect?
CVE-2025-67844 affects mintlify. Severity is medium (CVSS 5.0). The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provi
How urgent is CVE-2025-67844?
Priority 31/100. Public exploit reference
Software pages
Related CVEs
- CVE-2025-67846 MEDIUM 4.9 UPGRADE The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass securit
- CVE-2025-67845 MEDIUM 6.4 UPGRADE A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15
- CVE-2025-67843 HIGH 8.3 UPGRADE A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before
- CVE-2025-67842 MEDIUM 6.4 UPGRADE The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web sc