High severity · published Aug 10, 2025
CVE-2025-8794
LitmusChaos Litmus LocalStorage authorization
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality of the component LocalStorage Handler. The manipulation of the argument projectID leads to authorization bypass. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Litmus · LitmusChaos
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +14 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8794
Exploit
https://github.com/MaiqueSilva/VulnDB/blob/main/readme04.md
Permissions Required
https://vuldb.com/?ctiid.319322
Third Party Advisory
https://vuldb.com/?id.319322
Third Party Advisory
https://vuldb.com/?submit.625982
More from Litmus
9.9
CVE-2025-8795
LitmusChaos Litmus login access control
8.8
CVE-2025-8797
LitmusChaos Litmus LocalStorage permission
7.1
CVE-2025-14261
Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges
6.3
CVE-2025-8791
LitmusChaos Litmus list_projects improper authorization
5.4
CVE-2025-8796
LitmusChaos Litmus Delete Request delete_project authorization
