← fix library

MEDIUM Langfuse: Langfuse CVE-2025-64504 — cross-organization user enumeration

Why it matters

Your Langfuse version lets any logged-in user list the names and email addresses of members of other organizations on the same instance by swapping an orgId. No traces or prompts leak, but the member directory does.

Fix it — 2 steps

1. Upgrade Langfuse to 2.95.11 (v2 line) or 3.124.1 (v3 line) or later.
2. Reduce exposure meanwhile: disable public sign-up and require SSO, so only invited users exist on the instance.

Verify it’s fixed

curl -m 5 http://127.0.0.1:3000/api/public/health  # version must be >= 2.95.11 (v2) or >= 3.124.1 (v3)

References

• https://github.com/langfuse/langfuse/security/advisories/GHSA-94hf-6gqq-pj69
• https://nvd.nist.gov/vuln/detail/CVE-2025-64504