Access Control Flaw in Bugsink Error Tracking Tool
CVE-2026-47716

3.1LOW

Key Information:

Vendor

Bugsink

Status
Bugsink
Vendor
CVE Published:
26 May 2026

What is CVE-2026-47716?

In Bugsink, a self-hosted error tracking tool, an access control vulnerability allows unauthorized bulk actions on issues. Prior to version 2.2.0, the system authorizes access to the issue list based solely on project information in the URL, failing to ensure that the bulk actions applied to the issues actually belong to the specified project. This oversight could potentially allow users to manipulate issue data without having proper permissions, leading to significant security implications.

Affected Version(s)

bugsink < 2.2.0

References

https://github.com/bugsink/bugsink/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/bugsink/bugsink/releases/tag/2.2.0
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.