GitHub Advisoryadvisory · npm

GHSA-m654-769v-qjv7 Formio improperly authorized permission elevation through specially crafted request path

HIGH Published 2025-12-10 Modified 2025-12-11 Official page ↗
Aliases
CVE-2025-67718
Ecosystem
npm
Packages
formio
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-178
Reviewed
2025-12-10

Affected packages

• npm formio: < 3.5.7 → fixed in 3.5.7 • npm formio: >= 4.0.0-rc.1, < 4.4.3 → fixed in 4.4.3

Description

Security Advisory: Unauthorized permission elevation through specially crafted request path Summary: A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result in unauthorized data disclosure under certain configurations. Impact: In affected configurations, an unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. Affected versions: <= 3.5.6 <= 4.4.2 Fixed in: 3.5.7 4.4.3 Mitigation / Workarounds: Upgrade to 3.5.7 or later. Disclosure timeline: Discovered 2025-05-22; fixed 2025-05-30; publicly disclosed 2025-12.

Related

Alias · CVE (1)

  • CVE-2025-67718 Form.io is a combined Form and API platform for Serverless applications. vulnerability

Weakness · CWE (1)

  • CWE-178 Improper Handling of Case Sensitivity weakness

References