PT-2025-52407 · Mintlify · Mintlify Platform

Bymarshift + 2 · Published 2025-12-18 · Updated 2026-01-02 · CVE-2025-67846

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15

Description The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows attackers to bypass security patches and execute downgrade attacks. This is possible through predictable deployment identifiers on the Vercel preview domain. An attacker can identify the URL structure of a previous deployment containing unpatched vulnerabilities and force the application to load the vulnerable version by directly accessing the specific git-ref or deployment-id subdomain.

Recommendations Update Mintlify Platform to version 2025-11-15 or later.

Exploit

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-67846

Affected Products

Mintlify Platform

References · 12

• 🔥 https://kibty.town/blog/mintlify · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67846 · Security Note
• https://mintlify.com/blog/working-with-security-researchers-november-2025 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67846 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002099219616969043 · Twitter Post
• https://t.me/cveNotify/147543 · Telegram Post
• https://mintlify.com/docs/changelog · Note
• https://news.ycombinator.com/item?id=46317098 · Note
• https://t.me/cveNotify/146292 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001859309697708193 · Twitter Post
• https://twitter.com/MDLcsgo/status/2001729741632491872 · Twitter Post
• https://t.me/CVEtracker/40215 · Telegram Post