CVE-2026-47728
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced.
Risk Assessment
The risk involves potential data leakage or manipulation of error processing between projects, which could lead to exposure of sensitive information or disruption of application functionality.
Recommendation
It is recommended to immediately upgrade Bugsink to version 2.2.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Bugsink
See all- CVE-2026-47716Low
Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.
- CVE-2026-47715Low
Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.
- CVE-2026-44502Medium
Bugsink, a self-hosted error tracking tool, prior to version 2.1.3 has a vulnerability in webhook URL validation. A mismatch in URL parsing between Python and the requests library allows bypassing validation, so a URL may appear to target an allowed public host while the HTTP request actually goes to a different server.
Original NVD description (English source)
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.