Bugsink EUVD-2026-31860

Exploitation requires an authenticated session with at least low-privilege project membership (CVSS PR:L confirmed). The attacker must be a member of at least one project on the target Bugsink instance and must know or guess a debug ID that matches a sourcemap or debug file uploaded under a different project. For the minidump/debug-file variant specifically, the target instance must have the experimental FEATURE_MINIDUMPS flag enabled; this is a non-default configuration. The sourcemap variant requires no non-default feature flags. Exploitation is not automatable (SSVC: Automatable: no) because valid cross-project debug IDs must be known in advance rather than brute-forced at scale. The vulnerability does not apply to Hosted Bugsink SaaS tenants (separate instances per tenant) and has reduced practical impact on single-organization self-hosted instances where all project members share an implicit trust boundary.

The aggregate risk picture is low-to-moderate and consistently confirmed across multiple signals. CVSS 3.1 scores this at 4.3 (Medium) with AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network-reachable exploitation requiring only low-privilege authentication, but with scope unchanged and confidentiality impact limited to partial. EPSS at 0.03% (7th percentile) reflects near-zero observed exploitation activity. SSVC assessment corroborates: exploitation status is 'none,' the attack is not automatable (requires knowledge of a valid cross-project debug ID), and technical impact is only partial. The CVE is absent from CISA KEV and no public proof-of-concept has been identified. Real-world severity is further attenuated by Bugsink's deployment model: self-hosted instances are typically operated within a single organizational trust domain where project isolation is less critical, and the Hosted Bugsink SaaS uses per-tenant isolated instances so the issue does not cross tenant boundaries there. The primary concern is multi-tenant or multi-team self-hosted deployments where project data must be strictly segregated. There is no integrity or availability impact, so exploitation cannot be used to alter events or disrupt service.

An authenticated user who is a member of Project A on a shared Bugsink instance crafts or submits an error event that references a debug ID known (or guessed) to match a sourcemap previously uploaded for the confidential Project B. During event processing, Bugsink's global debug-ID resolution returns Project B's sourcemap, embedding source file context - potentially proprietary source code snippets - into the processed event visible to the Project A member. No public proof-of-concept code has been identified, but the attack requires only standard event submission via the Sentry-compatible ingest endpoint.