Sentry
CVE-2026-26004
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.
AnalysisAI
An Insecure Direct Object Reference (IDOR) vulnerability exists in Sentry versions prior to 26.1.0 within the GroupEventJsonView endpoint, allowing attackers to access event data across different organizations without proper authorization checks. This information disclosure vulnerability enables cross-organization data leakage where an authenticated attacker with access to one organization can enumerate and retrieve sensitive error tracking and performance monitoring data belonging to other organizations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | While CVSS and EPSS scores are not provided, the real-world risk is substantial based on available signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with legitimate access to Sentry in Organization A discovers that the GroupEventJsonView endpoint does not validate organization membership for group IDs. The attacker enumerates group IDs from Organization B (either through directory listing, timing attacks, or prior reconnaissance) and directly requests the JSON view of those groups using URLs like /api/0/groups/{org-b-group-id}/events/{event-id}/json/. … |
| Remediation | Immediately upgrade Sentry to version 26.1.0 or later, which includes the authorization bypass fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today