PT-2025-52405 · Mintlify · Mintlify Platform

Kibty · Published 2025-12-18 · Updated 2025-12-21 · CVE-2025-67844

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15

Description The GitHub Integration API in Mintlify Platform has an issue where it does not properly validate the repository owner and name fields during configuration. This allows remote attackers to potentially obtain sensitive repository metadata by providing repository owner and name fields that do not belong to the user's organization's GitHub App Installation ID. The API endpoint affected is the GitHub Integration API. The vulnerable parameters are the repository owner and name fields.

Recommendations Update Mintlify Platform to version 2025-11-15 or later.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-67844

Affected Products

Mintlify Platform

References · 11

• 🔥 https://kibty.town/blog/mintlify · Exploit
• https://mintlify.com/blog/working-with-security-researchers-november-2025 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67844 · Security Note
• https://t.me/cveNotify/146290 · Telegram Post
• https://twitter.com/CVEnew/status/2002099217087775221 · Twitter Post
• https://t.me/CVEtracker/40211 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1ps41pv/top_10_trending_cves_21122025 · Reddit Post
• https://mintlify.com/docs/changelog · Note
• https://news.ycombinator.com/item?id=46317098 · Note
• https://twitter.com/MDLcsgo/status/2001729741632491872 · Twitter Post