PT-2025-26760 · Sentry · Sentry

Nikolas-Ch · Published 2025-06-24 · Updated 2025-06-24 · CVE-2025-53073

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sentry versions 25.1.0 through 25.5.1

Description: The issue allows an authenticated attacker to access a project's issue endpoint and perform unauthorized actions, such as adding a comment, without being a member of the project's team. This can be done if the attacker knows a seven-digit issue ID, which is not treated as a secret and might be mentioned publicly or predicted.

Recommendations: For Sentry versions 25.1.0 through 25.5.1, consider restricting access to the issue endpoint until a patch is available. As a temporary workaround, avoid using the issue endpoint for sensitive projects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-53073

Affected Products

Sentry

References · 8

• 🔥 https://github.com/nikolas-ch/CVEs/blob/main/Sentry_Version%3E%3D25.1.0/Sentry_%3E%3D25.1.0_WeakAuthorizationControl.txt · Exploit
• 🔥 https://github.com/nikolas-ch/CVEs/tree/main/Sentry_Version%3E%3D25.1.0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53073 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53073 · Vendor Advisory
• https://github.com/getsentry/self-hosted/releases · Note
• https://t.me/cvetracker/26966 · Telegram Post
• https://twitter.com/CVEnew/status/1937565881116078206 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937598714048082261 · Twitter Post