{"id":"CVE-2025-59305","details":"Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry.","modified":"2026-08-12T03:51:21.779601554Z","published":"2025-09-24T00:00:00Z","database_specific":{"unresolved_ranges":[{"source":"DESCRIPTION","extracted_events":[{"introduced":"3.1"},{"fixed":"d67b317"}]}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59305.json"},"references":[{"type":"WEB","url":"https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59305.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59305"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/langfuse/langfuse","events":[{"introduced":"a56246059cb0915e5282ed0631397a9a920044ad"},{"fixed":"05b87199ec77aef18bc42e74653d83dd975e69c9"}],"database_specific":{"extracted_events":[{"introduced":"3.1.0"},{"fixed":"3.109.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:langfuse:langfuse:*:*:*:*:*:*:*:*"}}],"versions":["v3.108.0","v3.107.0","v3.106.4","v3.106.3","v3.106.2","v3.106.1","v3.106.0","v3.105.0","v3.104.0","v3.103.0","v3.102.0","v3.101.0","v3.100.0","v3.99.0","v3.98.2","v3.98.1","v3.98.0","v3.97.5","v3.97.4","v3.97.3","v3.97.2","v3.97.1","v3.97.0","v3.96.2","v3.96.1","v3.96.0","v3.95.2","v3.95.1","v3.95.0","v3.94.0","v3.93.0","v3.92.1","v3.92.0","v3.91.0","v3.90.0","v3.89.0","v3.88.1","v3.88.0","v3.87.1","v3.87.0","v3.86.1","v3.86.0","v3.85.2","v3.85.1","v3.85.0","v3.84.0","v3.83.0","v3.82.0","v3.81.1","v3.81.0","v3.80.1","v3.80.0","v3.79.1","v3.79.0","v3.78.2","v3.78.1","v3.78.0","v3.77.0","v3.76.0","v3.75.4","v3.75.3","v3.75.2","v3.75.1","v3.75.0","v3.74.0","v3.73.1","v3.73.0","v3.72.1","v3.72.0","v3.71.0","v3.70.0","v3.69.0","v3.68.0","v3.67.0","v3.66.1","v3.66.0","v3.65.3","v3.65.2","v3.65.1","v3.65.0","v3.64.0","v3.63.1","v3.63.0","v3.62.1","v3.62.0","v3.61.0","v3.60.1","v3.60.0","v3.59.1","v3.59.0","v3.58.0","v3.57.2","v3.57.1","v3.57.0","v3.56.0","v3.55.0","v3.54.1","v3.54.0","v3.53.0","v3.52.0","v3.51.2","v3.51.1","v3.51.0","v3.50.0","v3.49.1","v3.49.0","v3.48.1","v3.48.0","v3.47.0","v3.46.0","v3.45.2","v3.45.1","v3.45.0","v3.44.0","v3.43.0","v3.42.1","v3.42.0","v3.41.1","v3.41.0","v3.40.0","v3.39.0","v3.38.0","v3.37.0","v3.36.0","v3.35.1","v3.35.0","v3.34.1","v3.34.0","v3.33.1","v3.33.0","v3.32.1","v3.32.0","v3.31.0","v3.30.0","v3.29.1","v3.29.0","v3.28.3","v3.28.1","v3.28.0","v3.27.2","v3.27.1","v3.27.0","v3.26.0","v3.25.0","v3.24.1","v3.24.0","v3.23.0","v3.22.0","v3.21.0","v3.20.0","v3.19.0","v3.18.0","v3.17.1","v3.17.0","v3.16.0","v3.15.0","v3.14.0","v3.13.0","v3.12.0","v3.11.1","v3.11.0","v3.10.0","v3.9.0","v3.8.0","v3.7.1","v3.7.0","v3.6.2","v3.6.1","v3.6.0","v3.5.3","v3.5.2","v3.5.1","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.1","v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59305.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"}]}