CVE Feed

    Dashboard / CVE / CVE-2026-47728

    CVE-2026-47728

    Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.

    Published:May 26, 2026
    Last Modified:May 26, 2026
    EPS:May 26, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Bugsink
    Product
    Bugsink

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-47716 (CVSS 3.1) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view author…
    CVE-2026-47715 (CVSS 3.1) — Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event …
    CVE-2026-44502 (CVSS 4.3) — Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (parti…
    CVE-2026-40162 (CVSS 7.1) — Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identifi…
    CVE-2026-27614 (CVSS 9.3) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can…
    CVE-2025-64509 (CVSS 7.5) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compresse…
    CVE-2025-64508 (CVSS 7.5) — Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed br…
    CVE-2025-54433 (CVSS 7.2) — Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 throu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High