CVE-2023-39349

    Dashboard / Vulnerabilities / CVE-2023-39349

    CVE-2023-39349

    Published: 7 Aug 2023Last Modified: 12 Aug 2026

    Summary: Sentry vulnerable to privilege escalation via ApiTokensEndpoint

    Details: Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.

    References: https://github.com/getsentry/self-hosted/releases/tag/23.7.2, https://github.com/getsentry/sentry/releases/tag/23.7.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39349.json, https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c, https://nvd.nist.gov/vuln/detail/CVE-2023-39349, https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083, https://github.com/getsentry/sentry/pull/53850

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 25381dab2e56115a17798850b139862cc3c09ea6
    Fixed -c3274e82164c51a21a313ffe81d2d283da1f8ef4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39349 | CVE-DB