Sentry vulnerabilities

Sentry, an error tracking and performance monitoring tool, from version 21.12.0 to before 26.4.1 contains a critical vulnerability in the SAML SSO implementation. An attacker can take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim's email address must be known. The issue is patched in version 26.4.1.

Sentry from 23.11.0 to 26.7.0 with relocation feature enabled unsafely deserializes a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process.

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.

In Sentry, an error tracking and performance monitoring platform, there is a vulnerability that allows an attacker to retrieve a valid access token for another user during the OAuth token exchange. This issue affects versions from 10.0.0 to prior to 23.7.2 due to incorrect credential validation.

Sentry is an error tracking and performance monitoring platform. In versions from 22.1.0 to prior to 23.7.2, an attacker with access to a token with limited scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes.

Sentry is an error tracking and performance monitoring platform. In versions 8.21.0 through 23.5.2, an authenticated user could download a debug or artifact bundle from any organization and project with a known bundle ID, without needing permissions.