What is the CVSS score of CVE-2026-26004?

CVE-2026-26004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sentry are affected by CVE-2026-26004?

Organizations using Sentry should be aware of notable risk from CVE-2026-26004, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-26004?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Sentry CVE-2026-26004

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-18 security-advisories@github.com

Authentication Bypass Sentry

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 18, 2026 - 00:30 vuln.today

CVE Published

Mar 18, 2026 - 00:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability exists in Sentry versions prior to 26.1.0 within the GroupEventJsonView endpoint, allowing attackers to access event data across different organizations without proper authorization checks. This information disclosure vulnerability enables cross-organization data leakage where an authenticated attacker with access to one organization can enumerate and retrieve sensitive error tracking and performance monitoring data belonging to other organizations. The vulnerability has been patched in version 26.1.0, and a proof-of-concept is available via the referenced GitHub Security Lab advisory.

Technical ContextAI

The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaws where object identifiers used in direct object references are not properly validated against the requester's authorization context. Sentry's GroupEventJsonView endpoint, which serves JSON representations of grouped error events, fails to enforce cross-organization access controls. An attacker who is authenticated to Sentry in one organization context can manipulate direct object references (such as group IDs or event IDs) to access data from other organizations by crafting requests to the GroupEventJsonView endpoint without triggering authorization validation. This is particularly dangerous in Sentry's multi-tenant architecture where organizations are logically isolated but data access controls are inadequately enforced at the endpoint level.

RemediationAI

Immediately upgrade Sentry to version 26.1.0 or later, which includes the authorization bypass fix. Organizations unable to patch immediately should restrict network access to Sentry instances to trusted IP ranges and networks, enforce strong authentication mechanisms (multi-factor authentication), and monitor access logs for suspicious cross-organization data access patterns such as requests to GroupEventJsonView endpoints with group IDs from other organizations. Consider implementing Web Application Firewall rules to detect and block suspicious object reference manipulation attempts. Review audit logs for evidence of unauthorized access to events from other organizations during the vulnerability window. The patch is available at https://github.com/getsentry/sentry/pull/105601.