CVE-2025-67718 Formio improperly authorized permission elevation through specially crafted request path
Attackers can bypass authorization to access protected API endpoints and retrieve sensitive data via crafted request paths in Form.io.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67718?
CVE-2025-67718 is a high-severity missing authorization vulnerability in formio, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.
Which versions are affected by CVE-2025-67718?
4 open source packages ship an affected version, including formio.
| Package | Affected | Fixed in |
|---|---|---|
formio npm | All versions | 3.5.7 |
formio npm | All versions | 3.5.7 |
formio npm | From 4.0.0-rc.1 | 4.4.3 |
formio npm | From 4.0.0-rc.1 | 4.4.3 |
How do I fix CVE-2025-67718?
Upgrade formio to a fixed version for your release line: 3.5.7 or 4.4.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-67718 being exploited?
There is no known exploitation of CVE-2025-67718 in the wild and no public exploit code.
Sources
Also known as GHSA-m654-769v-qjv7.