CVE-2025-59305 Missing authorization in n/a
Authenticated users can invoke background migration endpoints, causing data corruption or denial of service due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59305?
CVE-2025-59305 is a high-severity missing authorization vulnerability in n/a, published on 24 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry.
Weakness: CWE-285
Which versions are affected by CVE-2025-59305?
It affects 1 product.
Products include Langfuse Langfuse.
How do I fix CVE-2025-59305?
No fix has been published for CVE-2025-59305 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59305 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59305 exists.
Other vulnerabilities in n/a
- CVE-2025-65107 Langfuse SSO Account Takeover via CSRF or phishing attack
- CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking
- CVE-2026-41487 Missing authorization in langfuse
- CVE-2025-64504 Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs
- CVE-2025-9799 Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery
Sources
Also known as GHSA-9m9r-362p-h3rf.