CVE-2025-67844
📋 TL;DR
This vulnerability in Mintlify Platform's GitHub Integration API allows attackers to access sensitive repository metadata by exploiting improper validation of repository ownership. Attackers can specify arbitrary repository owner/name fields to retrieve metadata that should be restricted to their organization's GitHub App Installation ID. Organizations using Mintlify Platform with GitHub integration are affected.
💻 Affected Systems
- Mintlify Platform
📦 What is this software?
Mintlify by Mintlify
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate and access metadata from private repositories across GitHub organizations, potentially revealing sensitive project information, contributor details, and repository structures.
Likely Case
Unauthorized access to repository metadata including repository names, descriptions, visibility status, and basic configuration details that could aid in reconnaissance for further attacks.
If Mitigated
With proper access controls and validation, only authorized users can access metadata for repositories belonging to their organization's GitHub App installation.
🎯 Exploit Status
Exploitation requires access to the GitHub Integration API endpoint and knowledge of repository names/owners to target.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions from 2025-11-15 onward
Vendor Advisory: https://www.mintlify.com/docs/changelog
Restart Required: No
Instructions:
1. Update Mintlify Platform to version dated 2025-11-15 or later. 2. Verify GitHub Integration API endpoints now properly validate repository ownership against GitHub App Installation ID.
🔧 Temporary Workarounds
Disable GitHub Integration API
allTemporarily disable the vulnerable GitHub Integration API endpoint until patching is complete.
# Configuration dependent - consult Mintlify documentation for API endpoint management
Implement API Gateway Validation
allAdd additional validation layer at API gateway to verify repository ownership matches organization's GitHub App Installation ID.
# Implementation specific to your API gateway solution
🧯 If You Can't Patch
- Implement strict network access controls to limit GitHub Integration API access to trusted IP ranges only.
- Enable detailed logging and monitoring for all GitHub Integration API requests to detect unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check Mintlify Platform version date. If before 2025-11-15 and GitHub Integration API is enabled, the system is vulnerable.Check Version:
Check Mintlify Platform admin dashboard or API for version/date information.Verify Fix Applied:
After updating, test GitHub Integration API with repository owner/name fields that don't belong to your organization's GitHub App Installation ID. Requests should be rejected.📡 Detection & Monitoring
Log Indicators:
- Failed repository ownership validation attempts
- GitHub Integration API requests for repositories outside organization scope
- Unusual patterns of metadata retrieval requests
Network Indicators:
- HTTP requests to GitHub Integration API endpoints with repository parameters
- API responses containing repository metadata for unauthorized repositories
SIEM Query:
source="mintlify" AND (api_endpoint="github-integration" OR endpoint="*github*") AND (response_code=200 OR status="success") | stats count by repository_owner, repository_name