CVE-2025-67844 Overview
CVE-2025-67844 is an authorization flaw in the Mintlify Platform GitHub Integration API. The vulnerability affects Mintlify versions released before 2025-11-15. Authenticated remote attackers can retrieve sensitive repository metadata by supplying arbitrary repository owner and name values. The API fails to verify that the supplied repository belongs to the GitHub App Installation ID tied to the requester's organization. The weakness is classified as [CWE-425] Direct Request (Forced Browsing) and applies to the SaaS documentation platform used by many engineering organizations.
Critical Impact
Authenticated Mintlify users can enumerate and read metadata for GitHub repositories outside their own organization by manipulating owner and name parameters submitted to the integration API.
Affected Products
- Mintlify Platform (SaaS) versions before the 2025-11-15 fix
- Mintlify GitHub Integration API
- Customer organizations using Mintlify with linked GitHub App Installations
Discovery Timeline
- 2025-12-19 - CVE-2025-67844 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-67844
Vulnerability Analysis
Mintlify integrates with customer GitHub repositories through a GitHub App Installation model. Each installation ties a specific set of repositories to a Mintlify organization. When a user configures the integration, the API accepts repository owner and name fields. The backend uses those fields to fetch metadata from GitHub.
The API does not verify that the specified repository is included in the caller's GitHub App Installation. An authenticated user can therefore reference repositories that belong to unrelated GitHub organizations. The Mintlify server acts as a confused deputy, resolving the request with its privileged installation context and returning metadata to the caller. Confidentiality is affected; integrity and availability are not. See the Mintlify security research blog and the Kibty research write-up for additional context.
Root Cause
The root cause is missing authorization on server-side inputs. The application trusts client-supplied repository identifiers rather than deriving them from the authenticated GitHub App Installation ID. This aligns with [CWE-425], where a resource is fetched directly from user input without a check that the requester is entitled to it.
Attack Vector
Exploitation requires a valid Mintlify account with permission to configure the GitHub integration. The attacker submits configuration requests specifying a target owner and name for a repository outside their organization. The server returns repository metadata retrieved through its own GitHub App context. No user interaction is required, and the attack is performed over the network against the hosted Mintlify API.
No verified public exploit code is available. Technical details are described in the referenced research write-ups.
Detection Methods for CVE-2025-67844
Indicators of Compromise
- Mintlify integration configuration events referencing repository owner or name values that do not match any repository present in the tenant's GitHub App Installation.
- GitHub App audit log entries showing metadata reads for repositories that were never intentionally connected to Mintlify.
- Unexpected changes to Mintlify GitHub integration configuration performed by non-administrative users.
Detection Strategies
- Correlate Mintlify configuration API activity with the list of repositories authorized by the linked GitHub App Installation, and alert on mismatches.
- Review GitHub organization audit logs for repository metadata access originating from the Mintlify GitHub App outside expected repositories.
- Enable and retain GitHub App webhook and audit events for installation_repositories and repository metadata access.
Monitoring Recommendations
- Monitor GitHub App installation scope changes and compare against Mintlify tenant configuration on a recurring basis.
- Track authentication and configuration activity by Mintlify users with integration privileges.
- Alert on anomalous enumeration patterns, such as repeated configuration attempts referencing many distinct repository owners.
How to Mitigate CVE-2025-67844
Immediate Actions Required
- Confirm your Mintlify tenant is running a version released on or after 2025-11-15, as Mintlify is a SaaS platform and the fix is applied server-side.
- Review the Mintlify GitHub integration configuration and remove any repositories that should not be linked.
- Rotate or reinstall the GitHub App Installation if unauthorized repository references are found in audit logs.
- Restrict which users in your organization can modify the Mintlify GitHub integration.
Patch Information
Mintlify addressed the issue in the platform update dated 2025-11-15. Because Mintlify is delivered as a hosted service, no customer-side upgrade action is required. Refer to the Mintlify security research blog and the Mintlify changelog for confirmation.
Workarounds
- Limit the GitHub App Installation to the minimum required repositories rather than granting organization-wide access.
- Enforce least privilege on Mintlify roles that can configure or modify the GitHub integration.
- Audit historical integration configuration events for repository identifiers outside your installation scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.