PT-2025-32470 · Unknown · Litmuschaos

Maique · Published 2025-08-10 · Updated 2025-08-10 · CVE-2025-8796

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: LitmusChaos versions up to 3.19.0

Description: A problematic issue exists in LitmusChaos related to missing authorization checks within the Delete Request Handler component. The vulnerability resides in the /auth/delete project/ file and is triggered by manipulating the projectID argument. This allows for remote deletion without proper authorization. The exploit details have been publicly disclosed, and the vendor was notified but did not respond.

Recommendations: LitmusChaos versions prior to 3.19.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2025-8796

Affected Products

Litmuschaos

References · 10

• 🔥 https://github.com/MaiqueSilva/VulnDB/blob/main/readme06.md · Exploit
• 🔥 https://vuldb.com/?submit.625989 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8796 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8796 · Vendor Advisory
• https://t.me/CVEtracker/29612 · Telegram Post
• https://vuldb.com/?ctiid.319324 · Note
• https://twitter.com/f8sbrightermind/status/1954438513891377367 · Twitter Post
• https://t.me/cveNotify/131587 · Telegram Post
• https://vuldb.com/?id.319324 · Note
• https://twitter.com/CVEnew/status/1954435546081587227 · Twitter Post