What is the CVSS score of CVE-2026-47728?

CVE-2026-47728 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47728?

Yes, a patch is available for CVE-2026-47728. Update the affected software to the latest version immediately.

Bugsink CVE-2026-47728

EUVD-2026-31860 MEDIUM

Missing Authorization (CWE-862)

2026-05-26 GitHub_M

GHSA-5389-f7vh-wxj8

Authentication Bypass Bugsink

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:50 vuln.today

Analysis Generated

Jun 08, 2026 - 12:50 vuln.today

Patch available

May 26, 2026 - 18:02 EUVD

DescriptionCVE.org

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.

AnalysisAI

Cross-project sourcemap and debug-file disclosure in Bugsink prior to 2.2.0 allows an authenticated user with access to one project to read source context or symbolication-derived data belonging to a separate project on the same instance. The root cause is a missing authorization scope check (CWE-862): debug IDs supplied by clients were resolved globally rather than constrained to the owning project, meaning a deliberate or accidental debug ID collision across projects leaks file metadata. No public exploit code exists and no active exploitation has been identified (CISA KEV: absent, EPSS: 0.03%, 7th percentile), making this a low-urgency but architecturally meaningful information disclosure for multi-project Bugsink deployments.

Technical ContextAI

Bugsink is a self-hosted Python/Django error-tracking platform (pip package 'bugsink') compatible with the Sentry ingestion protocol. Sourcemaps and minidump debug files are uploaded out-of-band via sentry-cli and associated with events using client-provided debug IDs. Prior to 2.2.0, the lookup path for these artifacts queried a global table keyed solely on debug ID, with no JOIN or filter on the owning project. CWE-862 (Missing Authorization) describes this class precisely: the application performs an operation - resolving debug metadata during event symbolication - without verifying that the requesting context (project A) is authorized to access the resource (metadata uploaded under project B). The CPE cpe:2.3:a:bugsink:bugsink:*:*:*:*:*:*:*:* covers all versions up to and including 2.1.3. The minidump/debug-file variant of the issue additionally required the experimental FEATURE_MINIDUMPS flag to be enabled, while the sourcemap path was reachable without any non-default feature flag.

RemediationAI

Upgrade Bugsink to version 2.2.0 or later, available via PyPI ('pip install --upgrade bugsink') and documented at https://github.com/bugsink/bugsink/releases/tag/2.2.0. Version 2.2.0 scopes sourcemap and debug-file lookups to the owning project, preferring project-scoped metadata and falling back to legacy unscoped records only for previously uploaded files. After upgrading, operators who want to eliminate the legacy fallback entirely should re-upload sourcemaps with explicit project slugs and then run the management command 'bugsink-manage delete_legacy_sourcemaps' to remove unscoped historical records. For deployments where an immediate upgrade is not possible and strict project isolation is required, restricting user accounts so that no single user holds membership in more than one project eliminates the cross-project exploitation path, since an attacker must control event ingestion in one project to reference metadata from another. This workaround has the operational trade-off of preventing legitimate cross-team user accounts. The vendor advisory is at https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8.