{"data":{"id":"6a39144a-23b2-4bfa-8f92-d923aaae6636","title":"CVE-2025-64504: Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions…","summary":"CVE-2025-64504 affects Langfuse, an open source LLM engineering platform, from version 2.70.0 up to (but not including) 2.95.11 and 3.124.1. In certain project membership APIs, the server trusted a user-controlled orgId in authorization checks, letting any authenticated user on the same instance list names and email addresses of members and invitees of another organization if they knew its ID. No traces, prompts or evaluations were exposed. The maintainers found no evidence of exploitation on Langfuse Cloud over the last 30 days.","solution":"Upgrade to v2.95.11 for major version 2 or v3.124.1 for major version 3. There are no known workarounds.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64504","publishedAt":"2025-11-10T22:15:39.273Z","cveId":"CVE-2025-64504","cweIds":["CWE-202"],"cvssScore":"5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Langfuse"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langfuse project membership APIs expose member names and emails across orgs","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00341,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:34.329Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}