PT-2026-43307 · Bugsink · Bugsink

Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-47728

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47728

Affected Products

Bugsink

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-47728 · Security Note
• https://github.com/bugsink/bugsink/releases/tag/2.2.0 · Note
• https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8 · Note