CVE-2025-67844
Unauthorized Access in Mintlify GitHub API Exposes Repository Data
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mintlify | platform | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-425 | The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the GitHub Integration API of the Mintlify Platform allows remote attackers to obtain sensitive repository metadata by exploiting the repository owner and name fields. The API does not properly validate that these fields belong to the specific GitHub App Installation ID associated with the user's organization, enabling unauthorized access to repository information.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive repository metadata, which may expose confidential information about the repositories. This could potentially aid attackers in further attacks or data breaches by revealing details about the codebase or repository structure.