EUVD-2026-31862
GHSA-g5vc-q7qc-v939
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This vulnerability is fixed in 2.2.0.
AnalysisAI
Cross-project issue state modification in Bugsink prior to 2.2.0 allows authenticated users with access to one project to alter the state of issues belonging to other projects if a valid target issue UUID is known. The bulk action endpoint authorizes based on the project in the URL but applies submitted issue IDs without verifying project membership, creating a project-boundary authorization bypass. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and the EPSS score of 0.03% (8th percentile) reflects minimal real-world exploitation probability.
Technical ContextAI
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the bulk action handler trusts client-submitted issue UUIDs without cross-referencing them against the URL-scoped project. Bugsink is a Django-based Python web application distributed as the pip package 'bugsink'. Its issue list view performs project-level authorization using the URL path, but the bulk state-change logic (resolve, mute, etc.) then operates on any submitted UUID regardless of project membership. CPE cpe:2.3:a:bugsink:bugsink:*:*:*:*:*:*:*:* covers all versions prior to 2.2.0. The fix in 2.2.0 enforces that bulk issue actions and event lookups are scoped to the authorized parent project, closing the object-level authorization gap.
RemediationAI
Upgrade to Bugsink 2.2.0 or later, which scopes bulk issue actions and event lookups to the authorized project, eliminating the boundary bypass. The release is available at https://github.com/bugsink/bugsink/releases/tag/2.2.0 and the security advisory at https://github.com/bugsink/bugsink/security/advisories/GHSA-g5vc-q7qc-v939. If immediate upgrade is not possible, restrict project membership so that users are only added to the specific projects they require - this reduces the attacker's opportunity window since exploitation requires authenticated access to at least one project on the instance. Given that exploitation also requires prior knowledge of a target issue UUID (not discoverable through the application), organizations with strict, minimal project membership assignments face materially reduced risk during a patching window. There are no significant trade-offs to the membership restriction workaround beyond administrative overhead.
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Authenticated arbitrary file write in Bugsink 2.1.0 allows remote attackers to write malicious content to filesystem loc
Cross-project sourcemap and debug-file disclosure in Bugsink prior to 2.2.0 allows an authenticated user with access to
Cross-project event data exposure in Bugsink prior to 2.2.0 allows an authenticated user with access to one project to r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today