CVE-2025-64504: Langfuse Information Disclosure Vulnerability

CVE-2025-64504 Overview

CVE-2025-64504 is a broken access control vulnerability in Langfuse, an open source large language model (LLM) engineering platform. The flaw exists in project membership APIs where the server trusted a user-controlled orgId parameter for authorization checks. Any authenticated user on the same Langfuse instance can enumerate names and email addresses of members and invitees from other organizations by supplying a known target organization ID. The vulnerability affects Langfuse versions from 2.70.0 up to (but not including) 2.95.11 and 3.124.1. Langfuse Cloud (EU, US, HIPAA) was affected until the fix was deployed on November 1, 2025.

Critical Impact
Authenticated users can enumerate member and invitee names and email addresses across organization boundaries when the target organization ID is known. No traces, prompts, or evaluations are exposed.

Affected Products

Langfuse self-hosted versions 2.70.0 through 2.95.10
Langfuse self-hosted versions 3.x prior to 3.124.1
Langfuse Cloud (EU, US, HIPAA) prior to the November 1, 2025 fix deployment

Discovery Timeline

2025-11-01 - Fix deployed to Langfuse Cloud
2025-11-10 - CVE-2025-64504 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64504

Vulnerability Analysis

The vulnerability is a broken access control issue [CWE-202] in the tRPC routes that power Langfuse's membership and invitations tables. Two endpoints, members.allFromProject and members.allInvitesFromProject, accepted an orgId field from the client and used that value in the database where clause of authorization queries. The server did not verify that the caller belonged to the supplied organization. Any authenticated user who could reach these endpoints and knew a target orgId could receive a paginated list of that organization's member and invitee names and email addresses. Impact is limited to personally identifying account metadata; traces, prompts, datasets, and evaluations are not reachable through this flaw.

Root Cause

The root cause is a Zod schema that extended an organization-level query with a project-level query while retaining a client-supplied orgId. Authorization logic downstream applied that untrusted value instead of resolving the organization from the authenticated project context. The patch removes orgId from the project-level input schema and requires the server to derive it internally.

Attack Vector

Exploitation requires network access to the Langfuse instance, a valid authenticated session, and knowledge of the target organization ID. The attacker replays the frontend membership table request while substituting the target orgId and reuses their own authentication token. For self-hosted deployments that disable email/password sign-up and rely on enterprise SSO (for example, Okta), the attack surface is reduced to users who can already authenticate through the identity provider.

typescript

// Server-side patch: web/src/features/rbac/server/allMembersRoutes.ts
// chore: protect allFromProject (#10136)
   ...paginationZod,
 });
 
-const projectLevelMemberQuery = orgLevelMemberQuery.extend({
-  projectId: z.string(), // optional, view project_role for specific project
+const projectLevelMemberQuery = z.object({
+  projectId: z.string(),
+  searchQuery: z.string().optional(),
+  ...paginationZod,
 });
 
 async function getMembers(
   prisma: PrismaClient,
   query:
     | z.infer<typeof orgLevelMemberQuery>
-    | z.infer<typeof projectLevelMemberQuery>,
+    | (z.infer<typeof projectLevelMemberQuery> & { orgId: string }),
   showAllOrgMembers: boolean = true,
 ) {
// Source: https://github.com/langfuse/langfuse/commit/67990ebfdcf0f0c32a6710efa7ddbda073812ab4

The fix redefines projectLevelMemberQuery so that orgId is no longer accepted from the client. The server-derived orgId is intersected onto the query type inside getMembers, ensuring authorization decisions run against a trusted value. An equivalent patch was applied to allInvitesFromProject in commit 6c2529049a4c962928c435984c81a547a497e3e5.

Detection Methods for CVE-2025-64504

Indicators of Compromise

Requests to the tRPC endpoints members.allFromProject or members.allInvitesFromProject where the supplied orgId does not match the caller's organization membership.
Repeated 200-response calls to membership APIs from a single user session enumerating multiple distinct orgId values.
Unusual pagination patterns against membership routes from non-administrator accounts.

Detection Strategies

Parse Langfuse application logs for tRPC calls to allFromProject and allInvitesFromProject and correlate the orgId parameter against the authenticated user's organization list.
Alert on any single account querying more than one organization's membership endpoints within a short window.
Ingest reverse-proxy access logs into a SIEM and build a rule that flags mismatches between session identity and requested orgId.

Monitoring Recommendations

Retain at least 30 days of Langfuse API access logs, mirroring the window the maintainers used when reviewing Langfuse Cloud.
Monitor for outbound bulk copies of email addresses that could indicate downstream misuse of enumerated data.
Track authentication events for anomalous account creation, especially in self-hosted deployments that still allow email/password sign-up.

How to Mitigate CVE-2025-64504

Immediate Actions Required

Upgrade self-hosted Langfuse to v2.95.11 for the 2.x branch or v3.124.1 for the 3.x branch.
Confirm Langfuse Cloud tenants are running the post-November 1, 2025 build; no customer action is required beyond verification.
Review the last 30 days of membership API access logs for cross-organization orgId values.
Restrict instance sign-up: disable email/password registration and enforce enterprise SSO where feasible.

Patch Information

The maintainers released fixes in Langfuse v2.95.11 and Langfuse v3.124.1. The underlying code changes are documented in commits 67990eb and 6c25290, and in GHSA-94hf-6gqq-pj69.

Workarounds

No official workarounds exist; upgrading is required to fully mitigate the issue.
As a compensating control, block external access to the Langfuse web console and restrict it to a trusted network segment while the upgrade is scheduled.
Rotate any organization identifiers that may have been shared publicly to reduce the value of leaked orgId values.

bash

# Upgrade example for Docker-based Langfuse deployments
# 2.x branch
docker pull langfuse/langfuse:2.95.11
docker compose up -d

# 3.x branch
docker pull langfuse/langfuse:3.124.1
docker compose up -d