Sentry vulnerable to improper authorization on debug and artifact file downloads

CVE-2023-36826

What is CVE-2023-36826?

In Sentry, a leading error tracking and performance monitoring platform, an issue was identified that allows an authenticated user to download debug or artifact bundles from any organization and project by using a known bundle ID. This vulnerability poses a risk as neither membership in the organization nor specific project permissions are required, potentially exposing sensitive information. The issue has been addressed in version 23.5.2, which enhances authorization checks to prevent unauthorized access. Users of Sentry's SaaS offerings are automatically protected, while self-hosted users should upgrade promptly to maintain security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References