CVE-2025-67718: Formio Unauthorized Permission Elevation via Crafted Request Path
Summary
CVE-2025-67718: Formio improperly authorized permission elevation through specially crafted request path. Affects formio across 2 version ranges.
< 3.5.7
>= 4.0.0-rc.1, < 4.4.3
Fixed in 3.5.7 or 4.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formio is an open-source form-building platform that allows users to create complex forms with ease. It provides a robust API for managing form data and user permissions. However, due to a flaw in its path handling, certain configurations of Formio are vulnerable to unauthorized access, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from improper authorization checks in Formio's handling of request paths. An attacker can exploit this flaw by crafting specific request paths that bypass security measures, allowing unauthorized access to protected API endpoints. This could lead to unauthorized data disclosure, especially in configurations where sensitive information is stored and accessible through these endpoints.
How To Fix
Latest published version: 4.11.0 as of 23 Oct 2026
npm install formio@4.11.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.5.73.5.7npm install formio@3.5.7 -
>= 4.0.0-rc.1, < 4.4.34.4.3npm install formio@4.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive API endpoints through additional authentication checks or by implementing stricter routing rules until the package is updated.
Conclusion
In summary, CVE-2025-67718 is a significant vulnerability in the Formio package that allows unauthorized access through crafted request paths. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for formio →
FAQ
CVE-2025-67718 is a vulnerability in the Formio package that allows unauthorized permission elevation through specially crafted request paths.
If you are using Formio versions 3.5.6 or earlier, or 4.4.2 or earlier, your installation is affected. You can check your version in the package-lock.json file.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, potentially compromising user information and application integrity.
You can upgrade Formio by running 'npm install formio@3.5.7' or 'npm install formio@4.4.3' in your terminal, depending on your version.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can also check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for formio.
