Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-47715

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view another project’s event data through an issue they are allowed to access. The affected views include the stacktrace, details, and breadcrumbs pages for an iss
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:2d717d84c7d165b032daab40bf34d17ca95484430b88db65d7633e6113dad7d5
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"bugsink","vendor":"bugsink","versions":[{"status":"affected","version":"< 2.2.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ec19eb5ac6c41caa308760de0403afa7dac5a74f8b4148bf9b24e4ef617ee06c · sha256:b60b521953eac34c… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ec19eb5ac6c41caa308760de0403afa7dac5a74f8b4148bf9b24e4ef617ee06c · sha256:b60b521953eac34c… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ec19eb5ac6c41caa308760de0403afa7dac5a74f8b4148bf9b24e4ef617ee06c · sha256:b60b521953eac34c… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/bugsink/bugsink/releases/tag/2.2.0","tags":["x_refsource_MISC"],"url":"https://github.com/bugsink/bugsink/releases/tag/2.2.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ec19eb5ac6c41caa308760de0403afa7dac5a74f8b4148bf9b24e4ef617ee06c · sha256:b60b521953eac34c… · /containers/cna/references/1
{"name":"https://github.com/bugsink/bugsink/security/advisories/GHSA-vx2f-6m6h-9frf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bugsink/bugsink/security/advisories/GHSA-vx2f-6m6h-9frf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ec19eb5ac6c41caa308760de0403afa7dac5a74f8b4148bf9b24e4ef617ee06c · sha256:b60b521953eac34c… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer