CVE-2025-67844 | THREATINT

Description

The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.

PUBLISHED Reserved 2025-12-12 | Published 2025-12-19 | Updated 2025-12-19 | Assigner mitre

MEDIUM: 5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Problem types

CWE-425 Direct Request ('Forced Browsing')

Product status

Default status

unaffected

Any version before 2025-11-15

affected

References

www.mintlify.com/docs/changelog

www.mintlify.com/...-with-security-researchers-november-2025

kibty.town/blog/mintlify/

news.ycombinator.com/item?id=46317098

cve.org (CVE-2025-67844)

nvd.nist.gov (CVE-2025-67844)

Download JSON