PT-2025-39319 · Langfuse · Langfuse

Published 2025-09-24 · Updated 2026-01-28 · CVE-2025-59305

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Langfuse versions prior to d67b317

Description An improper authorization issue exists in the background migration endpoints of Langfuse. Any authenticated user can invoke migration control functions, potentially leading to data corruption or denial of service. This is due to unauthorized access to TRPC endpoints, including backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry.

Recommendations Versions prior to d67b317 should be updated to d67b317 or later.

Exploit

Fix

DoS

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-59305

Affected Products

Langfuse

References · 19

• 🔥 https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study · Exploit
• https://osv.dev/vulnerability/CVE-2025-59305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59305 · Security Note
• https://github.com/langfuse/langfuse/pull/9028 · Note
• https://t.me/RNetsec/22050 · Telegram Post
• https://twitter.com/_r_netsec/status/1973156679492767857 · Twitter Post
• https://t.me/thebugbountyhunter/10268 · Telegram Post
• https://t.me/secharvester/20246 · Telegram Post
• https://twitter.com/CVEnew/status/1970996109326901262 · Twitter Post
• https://twitter.com/reverseame/status/2016398881756459031 · Twitter Post
• https://twitter.com/MavLevin/status/1973024742203597189 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971092285174563294 · Twitter Post
• https://t.me/CVEtracker/33278 · Telegram Post
• https://twitter.com/MavLevin/status/1973137724497600790 · Twitter Post
• https://depthfirst.webflow.io/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study · Note