{"id":"GHSA-m654-769v-qjv7","revision":"a089acc3b5144baab27827f2bcff8004","records":[{"revision":"a089acc3b5144baab27827f2bcff8004","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-m654-769v-qjv7","aliases":["CVE-2025-67718"],"title":"Formio improperly authorized permission elevation through specially crafted request path","description":"# Security Advisory: Unauthorized permission elevation through specially crafted request path\n\n**Summary:** A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result in unauthorized data disclosure under certain configurations.\n\n**Impact:** In affected configurations, an unauthenticated or unauthorized request could retrieve data from endpoints that should be protected.\n\n**Affected versions:** \n<= 3.5.6\n<= 4.4.2\n\n**Fixed in:** \n3.5.7\n4.4.3\n\n**Mitigation / Workarounds:** \nUpgrade to 3.5.7  or later. \n\n**Disclosure timeline:** \nDiscovered 2025-05-22; fixed 2025-05-30; publicly disclosed 2025-12.","state":0,"publishedAt":"2025-12-10T20:11:40+00:00","modifiedAt":"2025-12-11T16:20:52.699454+00:00","affected":[{"ecosystem":"npm","name":"formio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.5.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"formio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0-rc.1"},{"kind":"fixed","version":"4.4.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7","https://nvd.nist.gov/vuln/detail/CVE-2025-67718","https://github.com/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b","https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478","https://github.com/formio/formio"],"sourceUrl":"https://github.com/advisories/GHSA-m654-769v-qjv7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m654-769v-qjv7","identifiers":["GHSA-m654-769v-qjv7","CVE-2025-67718"]},"retained":false,"historicalAffected":[]}],"coverage":[]}