CVE-2025-60427
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-10-22

Assigner: MITRE

Description
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-21
Last Modified
2025-10-22
Generated
2026-05-07
AI Q&A
2025-10-21
EPSS Evaluated
2026-05-05
NVD
CVE-2025-60427
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
libretime libretime 3.0.0-alpha.10
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in LibreTime 3.0.0-alpha.10 and possibly earlier versions is a Broken Access Control issue where users with the DJ role can access analytics data through the Web UI and direct API calls. The backend fails to verify role-based permissions for analytics endpoints, allowing users with lower privileges to retrieve station-wide metrics that they should not have access to.


How can this vulnerability impact me? :

The impact of this vulnerability is information disclosure, where less privileged users (such as those with the DJ role) can access sensitive analytics data that should be restricted. This could lead to unauthorized access to station-wide metrics, potentially exposing operational or usage information that could be misused.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart