{"action":"Upgrade formio to 3.5.7 or later.","affected":[{"fixed":"3.5.7","introduced":"0"},{"fixed":"4.4.3","introduced":"4.0.0-rc.1"}],"component":"formio","cve_ids":["CVE-2025-67718"],"ecosystem":"npm","epss":0.00312,"exploited":false,"fixed_versions":["3.5.7","4.4.3"],"ghsa_id":"GHSA-m654-769v-qjv7","id":"tcs_01M5KFZS1PETQ9PWEB12FYGS9T","modified_at":"2025-12-11T16:20:52.699454Z","published_at":"2025-12-10T20:11:40Z","references":["https://osv.dev/vulnerability/GHSA-m654-769v-qjv7","https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7","https://nvd.nist.gov/vuln/detail/CVE-2025-67718","https://github.com/formio/formio/commit/1665b7c99e3cf3246db7ff0b4ff732231dc6903b","https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478","https://github.com/formio/formio"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-m654-769v-qjv7","url":"https://osv.dev/vulnerability/GHSA-m654-769v-qjv7"},{"source":"nvd","source_id":"CVE-2025-67718","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67718"}],"summary":"Formio improperly authorized permission elevation through specially crafted request path"}