Form.io CVE-2025-67718

Exploitation requires a Form.io deployment that relies on path-based authorization to protect API endpoints, since the flaw is improper case handling of URL path parameters (CWE-178) that lets a crafted path resolve to a protected route while bypassing the case-sensitive permission check. Per CVSS PR:N it is remotely reachable without authentication and needs no user interaction, but the vendor explicitly scopes impact to 'affected configurations' - so deployments not exposing protected endpoints via the vulnerable path-matching logic are the key LIMITING factor. Impact is confined to data disclosure (read access); no write/integrity or availability effect is indicated. Affected: formio <= 3.5.6 and >= 4.0.0-rc.1 < 4.4.3; patched in 3.5.7 and 4.4.3.

Signals are mostly consistent and point to a genuine but moderate-priority confidentiality risk rather than a critical mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity/availability impact, yielding a high base score of 8.7. However, EPSS is only 0.31% (22nd percentile), this CVE is NOT in CISA KEV, and no public exploit code was identified - so exploitation is unproven and not currently observed at scale, which tempers the headline score. A notable qualifier conflicts with the pure AV:N/AC:L/PR:N reading: both the NVD description and the GHSA advisory state the data disclosure occurs 'under certain configurations' / 'in affected configurations,' meaning the full unauthenticated impact is conditional on deployments that rely on path-based authorization - a limiting factor the base vector does not capture (consider AT:P / AC:H in practice). The CWE-178 (Improper Handling of Case Sensitivity) classification is corroborated by the fix commit, which simply lowercases URL path parameters before using them as keys, confirming this is a case-normalization authorization-bypass bug. Net: treat as a real patch-promptly issue for exposed Form.io deployments, but not an emergency on par with KEV-listed, actively exploited flaws.

An attacker who can reach a Form.io API over the network sends a request whose path uses altered letter casing (or otherwise exploits the pre-fix case-sensitive path parameter handling) to slip past path-based permission checks. Because authorization matching was case-sensitive while routing was not, the crafted path resolves to a protected endpoint while evading the guard, letting an unauthenticated or unauthorized caller read data that should be restricted. No public exploit code was identified at time of analysis, and impact is limited to data disclosure in affected configurations.