Langfuse CVE-2025-64504 — cross-organization user enumeration

Why it matters

Your Langfuse version lets any logged-in user list the names and email addresses of members of other organizations on the same instance by swapping an orgId. No traces or prompts leak, but the member directory does.

Fix it: 2 steps

Upgrade Langfuse to 2.95.11 (v2 line) or 3.124.1 (v3 line) or later.
Reduce exposure meanwhile: disable public sign-up and require SSO, so only invited users exist on the instance.

Verify it’s fixed

curl -m 5 http://127.0.0.1:3000/api/public/health  # version must be >= 2.95.11 (v2) or >= 3.124.1 (v3)

References

https://github.com/langfuse/langfuse/security/advisories/GHSA-94hf-6gqq-pj69
https://nvd.nist.gov/vuln/detail/CVE-2025-64504

CVE mapping behind this card: human-verified, last checked 2026-07-29.

Not sure if your stack is exposed?

Run the free check: usually under a minute, safe read-only probes.

Scan your stack