Bugsink vulnerabilities

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced.

Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.

Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.

Bugsink, a self-hosted error tracking tool, prior to version 2.1.3 has a vulnerability in webhook URL validation. A mismatch in URL parsing between Python and the requests library allows bypassing validation, so a URL may appear to target an allowed public host while the HTTP request actually goes to a different server.