Sentry CVE-2026-26004

While CVSS and EPSS scores are not provided, the real-world risk is substantial based on available signals. The attack vector is network-based and requires authentication (reducing immediate risk from anonymous attackers), but the authorization bypass means that any authenticated Sentry user can exploit this vulnerability with low complexity. The information disclosure impact is significant in a security monitoring tool context—error events often contain sensitive data including stack traces, environment variables, database connection strings, API keys, and personally identifiable information from user sessions. The vulnerability is not listed as actively exploited in KEV, but a proof-of-concept is publicly available via the GitHub Security Lab advisory, substantially lowering the barrier to exploitation. Organizations using Sentry for production error tracking face moderate-to-high risk depending on the sensitivity of data captured in their error events. The fact that this affects cross-organization access (not just elevation within a single organization) elevates severity, as it could impact multi-tenant SaaS deployments serving numerous customers.

An attacker with legitimate access to Sentry in Organization A discovers that the GroupEventJsonView endpoint does not validate organization membership for group IDs. The attacker enumerates group IDs from Organization B (either through directory listing, timing attacks, or prior reconnaissance) and directly requests the JSON view of those groups using URLs like /api/0/groups/{org-b-group-id}/events/{event-id}/json/. Since the endpoint fails to verify that the authenticated user belongs to Organization B, the request succeeds and returns sensitive event data including stack traces, environment variables, and potentially hardcoded credentials. A proof-of-concept demonstrating this attack vector is available in the GitHub Security Lab advisory, enabling rapid weaponization by threat actors with Sentry access.