UBUNTU-CVE-2025-27154

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2025-27154

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27154.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-27154

Upstream

CVE-2025-27154

Published

2025-02-27T14:15:00Z

Modified

2026-05-20T16:21:00.497974578Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- (644) permissions by default, when it could be locked down to rw------- (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

References

Affected packages

Ubuntu:25.10 / spotipy

Package

Name: spotipy
Purl: pkg:deb/ubuntu/spotipy?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.25.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-spotipy",
            "binary_version": "2.25.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27154.json"

Ubuntu:26.04:LTS / spotipy