PT-2025-42918 · Libretime · Libretime

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-60427

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreTime versions prior to 3.0.0-alpha.10

Description A flaw exists in access control within LibreTime, potentially allowing users with the DJ role to access analytics data. The backend does not properly enforce role-based permissions for analytics endpoints, leading to unauthorized access to station-wide metrics and potential information disclosure. The issue can be exploited through the Web UI and direct API calls.

Recommendations Update to a version later than 3.0.0-alpha.10.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-60427

Affected Products

Libretime

References · 7

• https://osv.dev/vulnerability/CVE-2025-60427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60427 · Security Note
• https://github.com/libretime/libretime/issues/1251 · Note
• https://github.com/libretime/libretime · Note
• https://twitter.com/VulmonFeeds/status/1980711275828048122 · Twitter Post
• https://beafn28.gitbook.io/beafn28/cve/broken-access-control-in-libretime-analytics-endpoints-cve-2025-60427 · Note
• https://twitter.com/CVEnew/status/1980691729436283382 · Twitter Post