CVE-2025-59305

State: Published
Severity: 7.6 High
Published: Sep 24, 2025
Updated: Sep 25, 2025
Reserved: Sep 12, 2025

Description

Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migration control functions. This can lead to data corruption or denial of service through unauthorized access to TRPC endpoints such as backgroundMigrations.all, backgroundMigrations.status, and backgroundMigrations.retry.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	CISA-ADP

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.