PT-2026-43307 · Bugsink · Bugsink

Shuluzhuo · Published 2026-05-26 · Updated 2026-06-08 · CVE-2026-47728

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.2.0

Description Bugsink is a self-hosted error tracking tool that resolved sourcemaps and debug files by debug ID without scoping the lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing to use sourcemap or debug-file metadata uploaded for another project within the same instance if the same debug ID was referenced. This could lead to the disclosure of source context or symbolication-derived context from other projects. For minidumps and debug files, this issue requires the experimental FEATURE MINIDUMPS to be enabled.

Recommendations Update to version 2.2.0. After upgrading, upload sourcemaps and debug files with project information. Run the command bugsink-manage delete legacy sourcemaps after upgrading to remove legacy projectless sourcemap metadata.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47728

GHSA-5389-F7VH-WXJ8

Affected Products

Bugsink

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47728.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-47728 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5389-f7vh-wxj8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47728 · Security Note
• https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8 · Note
• https://github.com/bugsink/bugsink/releases/tag/2.2.0 · Note
• https://github.com/bugsink/bugsink · Note
• https://reddit.com/r/VulnMatter/comments/1u0cddg/resumen_diario_de_vulnerabilidades_08062026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ty4ggl/resumen_diario_de_vulnerabilidades_06062026 · Reddit Post