Formio improperly authorized permission elevation through specially crafted request path
Security Advisory: Unauthorized permission elevation through specially crafted request path
Summary: A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result in unauthorized data disclosure under certain configurations.
Impact: In affected configurations, an unauthenticated or unauthorized request could retrieve data from endpoints that should be protected.
Affected versions: <= 3.5.6 <= 4.4.2
Fixed in: 3.5.7 4.4.3
Mitigation / Workarounds: Upgrade to 3.5.7 or later.
Disclosure timeline: Discovered 2025-05-22; fixed 2025-05-30; publicly disclosed 2025-12.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | formio | < 3.5.7, >= 4.0.0-rc.1, < 4.4.3 | 3.5.7, 4.4.3 |
References
- https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7
- https://nvd.nist.gov/vuln/detail/CVE-2025-67718
- https://github.com/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b
- https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478
- https://github.com/formio/formio
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-178- Platform
- npm
- Package
formio- Disclosed
- 10.12.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m654-769v-qjv7 - CC BY 4.0
Vulnerability history: formio
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 06.2022 12.2025
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 0
-
Formio improperly authorized permission elevation through specially crafted request path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.