BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-10-22

Assigner: MITRE

Description

LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-21

Last Modified

2025-10-22

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60427

Affected Vendors & Products

Vendor	Product	Version / Range
libretime	libretime	3.0.0-alpha.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in LibreTime 3.0.0-alpha.10 and possibly earlier versions is a Broken Access Control issue where users with the DJ role can access analytics data through the Web UI and direct API calls. The backend fails to verify role-based permissions for analytics endpoints, allowing users with lower privileges to retrieve station-wide metrics that they should not have access to.

Impact Analysis

The impact of this vulnerability is information disclosure, where less privileged users (such as those with the DJ role) can access sensitive analytics data that should be restricted. This could lead to unauthorized access to station-wide metrics, potentially exposing operational or usage information that could be misused.

Hi! I’m here to help you understand CVE-2025-60427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70