Vulnerability · Published Dec 19, 2025 · Assigned by mitre
CVE-2025-67846
Medium 4.9
In plain English
A medium-severity security flaw in Mintlify Platform from Mintlify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment identifiers on the Vercel preview domain. An attacker can identify the URL structure of a previous deployment that contains unpatched vulnerabilities. By browsing directly to the specific git-ref or deployment-id subdomain, the attacker can force the application to load the vulnerable version.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mintlify | Mintlify Platform | 0 – before 2025-11-15 |
Weakness: CWE-472 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N