Medium severity · published Aug 10, 2025
CVE-2025-8791
LitmusChaos Litmus list_projects improper authorization
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_projects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Litmus · LitmusChaos
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +14 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8791
Exploit
https://github.com/MaiqueSilva/VulnDB/blob/main/readmi1.md
Permissions Required
https://vuldb.com/?ctiid.319319
Third Party Advisory
https://vuldb.com/?id.319319
Third Party Advisory
https://vuldb.com/?submit.625949
More from Litmus
9.9
CVE-2025-8795
LitmusChaos Litmus login access control
8.8
CVE-2025-8797
LitmusChaos Litmus LocalStorage permission
7.8
CVE-2025-8794
LitmusChaos Litmus LocalStorage authorization
7.1
CVE-2025-14261
Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges
5.4
CVE-2025-8796
LitmusChaos Litmus Delete Request delete_project authorization