CVE-2025-64504
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-12-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langfuse | langfuse | From 2.70.0 (inc) to 2.95.11 (exc) |
| langfuse | langfuse | From 3.0.0 (inc) to 3.124.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-202 | When trying to keep information confidential, an attacker can often infer some of the information by using statistics. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Langfuse occurs because the server trusted a user-controlled organization ID (orgId) in certain project membership APIs for authorization checks. This allowed any authenticated user on the same Langfuse instance to enumerate names and email addresses of users in another organization if they knew that organization's ID. The exposure is limited to names and email addresses of members or invitees, with no access to sensitive customer data like traces, prompts, or evaluations. Exploitation requires a valid user account, knowledge of the target orgId, and use of the API request with a modified orgId parameter.
How can this vulnerability impact me? :
The impact of this vulnerability is limited disclosure of user names and email addresses from other organizations within the same Langfuse instance. This could lead to privacy concerns or targeted phishing attacks. However, no sensitive customer data or system integrity is affected. For self-hosted deployments with Enterprise SSO configured and email/password sign-up disabled, the attack surface is reduced to internal users only. There is no evidence that this vulnerability was exploited in Langfuse Cloud based on recent access log reviews.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability results in unauthorized disclosure of user names and email addresses, which are personal data under regulations like GDPR. This could be considered a data breach requiring notification and remediation. Langfuse Cloud HIPAA environments were affected until the fix was deployed on November 1, 2025. However, no evidence of exploitation was found. Organizations using affected versions should upgrade to mitigate compliance risks related to unauthorized personal data exposure.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Langfuse to version 2.95.11 or later for major version 2, or version 3.124.1 or later for major version 3. There are no known workarounds, so upgrading is required to fully mitigate the issue.