Authorization Vulnerability in Sentry Error Tracking Platform

CVE-2024-45606

What is CVE-2024-45606?

An authenticated user in Sentry, a developer-first error tracking and performance monitoring platform, could potentially mute alert rules across various organizations and projects using a known rule ID, regardless of their membership or permission status. Although no instances of alerts being muted by unauthorized parties have been documented, this flaw raised significant security concerns. To address this issue, an update was released to enforce proper authorization checks for requests aimed at muting alert rules. Users without the requisite permissions will be unable to mute alerts. While Sentry SaaS users are unaffected and require no action, self-hosted Sentry users must upgrade to version 24.9.0 or later to mitigate this risk.

References