Formio improperly authorized permission elevation through specially crafted request path

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-67718 · Microsoft / collected KEV context

EUVD-2025-202594

GHSA-m654-769v-qjv7

cve-program · CVE-2025-67718

• https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7
• https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478

euvd · EUVD-2025-202594

• https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7
• https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478

nvd · CVE-2025-67718

• https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478
• https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7

osv · GHSA-m654-769v-qjv7

• https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7
• https://nvd.nist.gov/vuln/detail/CVE-2025-67718
• https://github.com/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b
• https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478
• https://github.com/formio/formio

No related operational record is retained in the current change model.