Cyber Resilience

CVE-2025-8794

Access Control in Litmuschaos Litmus ≤ 3.19.0

Public PoCAccess Control
Published
10 August 2025
Modified
17 June 2026
CVSS Score v4 1.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0024 15th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2025-8794 is a low-severity Improper Authorization (CWE-285) vulnerability in Litmuschaos Litmus. Its CVSS base score is 1.9 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality of the component LocalStorage Handler. The manipulation of the argument projectID leads to authorization bypass. Local…

more

access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The authorization bypass vulnerability (CVE-2025-8794) in LitmusChaos Litmus allows an authenticated user to manipulate the projectID in browser LocalStorage, lacking backend validation, resulting in privilege escalation to owner-level access on unauthorized projects.

CVEs Like This One

CVE-2025-8791Same product: Litmuschaos Litmus
CVE-2025-8795Same product: Litmuschaos Litmus
CVE-2025-8797Same product: Litmuschaos Litmus
CVE-2025-8796Same product: Litmuschaos Litmus
CVE-2025-8793Same product: Litmuschaos Litmus
CVE-2025-8792Same product: Litmuschaos Litmus
CVE-2025-6329Shared CWE-285, CWE-639
CVE-2025-65030Shared CWE-285, CWE-639
CVE-2025-7938Shared CWE-285, CWE-639
CVE-2025-65020Shared CWE-285, CWE-639

Affected Assets

litmuschaos
litmus
≤ 3.19.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces server-side authorization decisions on projectID rather than trusting client-side LocalStorage values.

prevent

Limits the privileges granted to any locally authenticated subject so a bypassed projectID check yields minimal access.

prevent

Enforces information-flow rules that would block unauthorized project data flows even if the client-supplied identifier is manipulated.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch and eliminate most authorization defects before release, yet a single broad outcome cannot address every design, role, and runtime facet of CWE-285.

PR.AA-01 partial match
prevents

PR.AA-01 supplies managed identities and access-request workflows that can support downstream authorization decisions, yet does nothing to enforce or verify authorization checks inside a product, leaving CWE-285 fully unaddressed by this control alone.

PR.PS-05 none match
prevents

PR.PS-05 blocks unauthorized binaries/DNS while CWE-285 is an in-product authorization-check defect, so the control neither prevents the weakness nor removes any of its risk.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect missing authorization checks but does not prevent the weakness in production.

prevents

Granular, policy-driven assignment of permissions and dynamic enforcement of those permissions prevent the incorrect or missing authorization decisions that lead to improper authorization flaws.

prevents

By requiring documented authorization rules and periodic policy reviews, the control makes it less likely that authorization decisions will be omitted or implemented inconsistently across applications.

prevents

Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.

prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

detects

Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.

References