Medium severity · published Aug 10, 2025
CVE-2025-8796
LitmusChaos Litmus Delete Request delete_project authorization
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/delete_project/ of the component Delete Request Handler. The manipulation of the argument projectID leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Litmus · LitmusChaos
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +14 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8796
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8796
Exploit
https://github.com/MaiqueSilva/VulnDB/blob/main/readme06.md
Permissions Required
https://vuldb.com/?ctiid.319324
Third Party Advisory
https://vuldb.com/?id.319324
Third Party Advisory
https://vuldb.com/?submit.625989
More from Litmus
9.9
CVE-2025-8795
LitmusChaos Litmus login access control
8.8
CVE-2025-8797
LitmusChaos Litmus LocalStorage permission
7.8
CVE-2025-8794
LitmusChaos Litmus LocalStorage authorization
7.1
CVE-2025-14261
Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges
6.3
CVE-2025-8791
LitmusChaos Litmus list_projects improper authorization