PT-2026-43306 · Bugsink · Bugsink

Susen2 · Published 2026-05-26 · Updated 2026-06-06 · CVE-2026-47716

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.2.0

Description Bugsink is a self-hosted error tracking tool. A project-boundary authorization issue exists in the issue list view, which supports bulk actions such as resolving or muting selected issues. The system authorizes access based on the project specified in the URL but applies bulk actions to the submitted issue IDs without verifying that those issues belong to the authorized project. This allows an authenticated user with access to one project to modify the state of an issue in another project, provided they possess a valid target issue UUID. Because UUIDs are not easily guessable and there is no enumeration path, the risk is limited. Additionally, since the software is typically self-hosted within a single trust domain or deployed in separate instances per tenant, this does not normally result in cross-tenant access.

Recommendations Update to version 2.2.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-47716

GHSA-G5VC-Q7QC-V939

Affected Products

Bugsink

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47716.json · Exploit
• https://osv.dev/vulnerability/GHSA-g5vc-q7qc-v939 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47716 · Security Note
• https://github.com/bugsink/bugsink/releases/tag/2.2.0 · Note
• https://github.com/bugsink/bugsink/security/advisories/GHSA-g5vc-q7qc-v939 · Note
• https://github.com/bugsink/bugsink · Note
• https://reddit.com/r/VulnMatter/comments/1ty4ggl/resumen_diario_de_vulnerabilidades_06062026 · Reddit Post