CVE-2025-64504

Langfuse vulnerability CVE-2025-64504 affects 2.70.0–2.95.10 and 3.0.0–3.124.0. The issue stems from the server trusting a user‑controlled orgId in project membership APIs, allowing any authenticated user on the same instance to enumerate member names and email addresses from other organizations ...