CVE-2025-57813 is a medium-severity vulnerability affecting traQ, a messenger application developed by traPtitech for the Digital Creators Club traP. The vulnerability is categorized under CWE-532, which involves the insertion of sensitive information into log files. Specifically, in versions of traQ prior to 3.25.0, sensitive data such as OAuth tokens are inadvertently recorded in log files when an SQL error occurs. An attacker with sufficient privileges to view these log files could exploit this by intentionally triggering SQL errors, for example by placing a high load on the database to cause query failures. This would cause the application to log sensitive tokens, which the attacker could then access and misuse. The vulnerability requires that the attacker already has some level of privilege (PR:H) and that the attack vector is network-based (AV:N), but it does not require user interaction (UI:N). The vulnerability impacts confidentiality and integrity, as exposure of OAuth tokens can lead to unauthorized access and potential manipulation of user sessions or data. The vulnerability does not affect availability. The issue has been addressed in traQ version 3.25.0. If upgrading is not feasible, a temporary mitigation involves restricting access permissions to SQL error logs to prevent unauthorized viewing of sensitive information. No known exploits are currently reported in the wild.

For European organizations using traQ as a communication platform, this vulnerability poses a risk of sensitive credential leakage, specifically OAuth tokens, which could lead to unauthorized access to user accounts or services integrated with traQ. Given that OAuth tokens often grant access to various APIs or services, their compromise could cascade into broader data breaches or unauthorized actions within connected systems. The requirement for an attacker to have privileges to view logs limits the attack surface, but insider threats or compromised accounts with elevated permissions could exploit this vulnerability. The potential impact includes loss of confidentiality of sensitive tokens, possible integrity violations through unauthorized actions, and reputational damage if sensitive communications or credentials are exposed. Organizations relying on traQ for internal or external communications should be aware of this risk and act promptly to patch or mitigate it. The medium CVSS score (5.9) reflects the moderate risk, balancing the impact of token exposure against the higher privilege requirements and lack of user interaction needed.

1. Upgrade traQ to version 3.25.0 or later, where the vulnerability has been patched to prevent sensitive information from being logged during SQL errors. 2. If immediate upgrading is not possible, implement strict access controls on SQL error log files. Ensure that only trusted administrators with a clear need can access these logs. 3. Regularly audit log file permissions and access logs to detect any unauthorized access attempts. 4. Monitor database performance and error rates to detect abnormal loads or error patterns that could indicate attempts to trigger SQL errors maliciously. 5. Implement network segmentation and role-based access controls to limit the number of users who can view sensitive logs. 6. Educate administrators and users with elevated privileges about the risks of exposing sensitive tokens and the importance of secure log management. 7. Consider additional logging configurations that mask or exclude sensitive tokens from logs. 8. Review OAuth token lifecycle policies to ensure tokens are short-lived and can be revoked promptly if compromised.