PT-2025-39319 · Langfuse · Langfuse

CVE-2025-59305 · Publicado 2025-09-24 · Atualizado 2026-01-28

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Langfuse versions prior to d67b317

Description An improper authorization issue exists in the background migration endpoints of Langfuse. Any authenticated user can invoke migration control functions, potentially leading to data corruption or denial of service. This is due to unauthorized access to TRPC endpoints, including backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry.

Recommendations Versions prior to d67b317 should be updated to d67b317 or later.

Exploit

Correção

DoS

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2025-59305

Produtos afetados

Langfuse

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59305.json · Exploit
• 🔥 https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study · Exploit
• https://github.com/langfuse/langfuse/pull/9028 · Nota
• https://t.me/defcon_news/132135 · Publicação no Telegram
• https://depthfirst.webflow.io/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study · Nota
• https://twitter.com/MavLevin/status/1973137724497600790 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-59305 · Aviso do Fabricante
• https://t.me/secharvester/20246 · Publicação no Telegram
• https://t.me/thebugbountyhunter/10268 · Publicação no Telegram
• https://t.me/cveNotify/139150 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-59305 · Nota de Segurança
• https://twitter.com/Dinosn/status/1973250861192396810 · Publicação no Twitter
• https://twitter.com/reverseame/status/2016398881756459031 · Publicação no Twitter
• https://twitter.com/MavLevin/status/1973024742203597189 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1970996109326901262 · Publicação no Twitter