{"id":"EUVD-2025-202594","enisaUuid":"988c8e26-1c73-361d-984d-28482425daed","description":"Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.","datePublished":"Dec 11, 2025, 12:58:43 AM","dateUpdated":"Dec 11, 2025, 3:35:44 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7\nhttps://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478\n","aliases":"CVE-2025-67718\nGHSA-m654-769v-qjv7\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"98f0ca34-9f45-3373-89aa-01f24259daad","product":{"name":"formio","vendor":{"name":"formio"}},"product_version":"4.0.0-rc.1, \u003c 4.4.3"},{"id":"f4654917-fdcf-374c-b8a9-e68eb7551691","product":{"name":"formio","vendor":{"name":"formio"}},"product_version":"\u003c 3.5.7"}],"enisaIdVendor":[{"id":"c8df7dea-d970-3e5c-8ee9-b73aec214778","vendor":{"name":"formio"}}],"enisaIdVulnerability":[{"id":"5e6c390e-69d9-3573-85c3-fb46a8933265","vulnerability":{"id":"GHSA-m654-769v-qjv7","description":"Formio improperly authorized permission elevation through specially crafted request path","datePublished":"Dec 10, 2025, 8:11:40 PM","dateUpdated":"Dec 11, 2025, 3:51:30 PM","baseScore":0.0,"references":"https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-67718\nhttps://github.com/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b\nhttps://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478\nhttps://github.com/formio/formio\n","enisa_id":"EUVD-2025-202594\n","aliases":"GHSA-m654-769v-qjv7\nCVE-2025-67718\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d15b6bf1-5ac1-37e9-a9ca-3971eb33cedc","vulnerability":{"id":"CVE-2025-67718","description":"Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.","datePublished":"Dec 11, 2025, 12:58:43 AM","dateUpdated":"Dec 11, 2025, 3:35:44 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7\nhttps://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478\n","enisa_id":"EUVD-2025-202594\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 4, 2026, 7:20:05 AM","vulnerabilityProduct":[{"id":"7039938f-a65e-34fc-b94e-503e142f9679","product":{"name":"formio","vendor":{"name":"formio"}},"product_version":"\u003c 3.5.7"},{"id":"ba0da449-2255-3c27-88b3-4db7522167a0","product":{"name":"formio","vendor":{"name":"formio"}},"product_version":"4.0.0-rc.1, \u003c 4.4.3"}],"vulnerabilityVendor":[{"id":"24fcf175-67da-3e69-8035-6947a2ca4442","vendor":{"name":"formio"}}]}}],"enisaIdAdvisory":[]}