The Langfuse platform exposes a public Slack installation endpoint that accepts a project identifier without requiring authentication. The endpoint begins an OAuth flow using the supplied projectId, preserves it throughout the exchange, and records the installation data under that project. This flaw allows an unauthenticated actor to link any Slack workspace to any Langfuse project, potentially exposing prompt updates or replacing existing prompt‑to‑Slack integrations. The weakness is a type of authorization bypass (CWE‑284) and insecure direct object reference (CWE‑862).

All releases of Langfuse up to and including version 3.146.0 are affected. The vulnerability exists in the /api/public/slack/install endpoint used by every deployment of these versions.

The vulnerability scores moderate with a CVSS base of 6.3 and an EPSS estimate of less than 1 %, indicating very low current exploitation probability, but it is not listed in the CISA KEV catalog. An attacker can trigger the flaw by making an unauthenticated HTTP request to the public Slack install endpoint, which is typically reachable from any network that can reach the Langfuse instance. Successful exploitation would let the attacker associate their Slack workspace with an arbitrary project and receive or alter prompt data within that project. Because the exploit path requires only network access to the public API, the threat surface is broad, though the impact is limited to the affected project rather than the entire system.