CVE Feed

    Dashboard / CVE / CVE-2026-47715

    CVE-2026-47715

    Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view another project’s event data through an issue they are allowed to access. The affected views include the stacktrace, details, and breadcrumbs pages for an issue event. This vulnerability is fixed in 2.2.0.

    Published:May 26, 2026
    Last Modified:May 28, 2026
    EPS:May 26, 2026
    EPSS Score:0.00025
    CVSS Score:3.1

    Affected Products

    Vendor
    Bugsink
    Product
    Bugsink

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-47716 (CVSS 3.1) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view author…
    CVE-2026-47728 (CVSS 4.3) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by d…
    CVE-2026-44502 (CVSS 4.3) — Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (parti…
    CVE-2026-40162 (CVSS 7.1) — Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identifi…
    CVE-2026-27614 (CVSS 9.3) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can…
    CVE-2025-64509 (CVSS 7.5) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compresse…
    CVE-2025-64508 (CVSS 7.5) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed br…
    CVE-2025-54433 (CVSS 7.2) — Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 throu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High