EUVD-2026-31861
GHSA-vx2f-6m6h-9frf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view another project’s event data through an issue they are allowed to access. The affected views include the stacktrace, details, and breadcrumbs pages for an issue event. This vulnerability is fixed in 2.2.0.
AnalysisAI
Cross-project event data exposure in Bugsink prior to 2.2.0 allows an authenticated user with access to one project to read event data - including stacktraces, breadcrumbs, and raw event details - belonging to a separate, unauthorized project. The flaw (CWE-639) exists because issue event views accept a direct event UUID from the URL without verifying that the event belongs to the project in the same URL path. Exploitation is materially constrained by the requirement for both an authenticated session and prior knowledge of a valid target event UUID; no public exploit has been identified and EPSS sits at 0.03% (7th percentile).
Technical ContextAI
Bugsink is a Python pip-installable, self-hosted error tracking platform (CPE: cpe:2.3:a:bugsink:bugsink:*:*:*:*:*:*:*:*). Issue event views expose three pages - stacktrace, details, and breadcrumbs - each routed by a direct event UUID embedded in the URL. In versions before 2.2.0, these views resolved the event object using the UUID alone, without asserting that the resolved event also belonged to the issue and project present elsewhere in the same URL. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) pattern: the application delegates access control to a user-supplied identifier rather than enforcing object-level ownership. The 2.2.0 fix closes the gap by requiring lookups to satisfy both the authorized issue and project scope simultaneously.
RemediationAI
Upgrade Bugsink to version 2.2.0 or later; this is the vendor-released patch that resolves the issue by scoping direct event lookups to both the authorized issue and project. Upgrade guidance and changelog details are available at https://github.com/bugsink/bugsink/releases/tag/2.2.0 and the security advisory at https://github.com/bugsink/bugsink/security/advisories/GHSA-vx2f-6m6h-9frf. If an immediate upgrade is not possible, the most effective compensating control is to audit and restrict project membership on the instance so that no user with access to a low-sensitivity project can also reach high-sensitivity project data; this does not eliminate the flaw but removes the conditions required to exploit it. Restricting network access to the Bugsink instance to a known-trusted user population also reduces exposure, though it does not address the underlying authorization defect.
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Authenticated arbitrary file write in Bugsink 2.1.0 allows remote attackers to write malicious content to filesystem loc
Cross-project sourcemap and debug-file disclosure in Bugsink prior to 2.2.0 allows an authenticated user with access to
Cross-project issue state modification in Bugsink prior to 2.2.0 allows authenticated users with access to one project t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today