CVE-2025-60427
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-10-22

Assigner: MITRE

Description
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-21
Last Modified
2025-10-22
Generated
2026-06-16
AI Q&A
2025-10-21
EPSS Evaluated
2026-06-15
NVD
CVE-2025-60427
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
libretime libretime 3.0.0-alpha.10
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in LibreTime 3.0.0-alpha.10 and possibly earlier versions is a Broken Access Control issue where users with the DJ role can access analytics data through the Web UI and direct API calls. The backend fails to verify role-based permissions for analytics endpoints, allowing users with lower privileges to retrieve station-wide metrics that they should not have access to.

Impact Analysis

The impact of this vulnerability is information disclosure, where less privileged users (such as those with the DJ role) can access sensitive analytics data that should be restricted. This could lead to unauthorized access to station-wide metrics, potentially exposing operational or usage information that could be misused.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-60427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart