Is CVE-2026-47715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47715 being exploited in the wild.

How severe is CVE-2026-47715?

Low severity, with a CVSS score of 3.1, published 26 May 2026.

Which products and versions are affected?

Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

Is there a fix for CVE-2026-47715?

Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47715 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47715?

Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47715: Bugsink authorization bypass in issue event views

Q: Which products and versions are affected?

Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

Q: Is there a fix for CVE-2026-47715?

Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47715 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47715?

Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47715 · Severity: low · CVSS 3.1 · Published 2026-05-26

Bugsink, an error-tracking and log-aggregation tool, contains a flaw where a logged-in user can view error event data from projects they are not authorized to access. To exploit this, an attacker must already know the specific unique identifier (UUID) of the target event, which is difficult to guess. While this could lead to the exposure of sensitive technical data like stack traces, the risk is limited in environments where Bugsink is self-hosted or isolated per tenant.

Technologies: Bugsink, bugsink (PyPI). Vendors: Bugsink, PyPI.

Quick answers

Is CVE-2026-47715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47715 being exploited in the wild.
How severe is CVE-2026-47715?: Low severity, with a CVSS score of 3.1, published 26 May 2026.
Which products and versions are affected?: Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.
Is there a fix for CVE-2026-47715?: Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47715 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47715?: Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bugsink (PyPI): upgrade to 2.2.0 or later
```
pip install "bugsink>=2.2.0"
```

Technical details

Bugsink is vulnerable to an authorization bypass (CWE-639) in its issue event pages, including stacktrace, details, and breadcrumbs views. The application accepts a direct event UUID from the URL but fails to verify that the requested event belongs to the project or issue the user is authorized to view. An authenticated attacker with network access can view cross-project event data if they possess a valid target event UUID. The vulnerability is mitigated by the high complexity of guessing UUIDs and the typical deployment model of separate instances per tenant. The issue is fixed in version 2.2.0 by enforcing that event lookups match both the authorized issue and project.

Affected products

bugsink bugsink < 2.2.0

Identifiers

CVE-2026-47715
GHSA-vx2f-6m6h-9frf
PYSEC-2026-2407

Timeline

2026-05-21: disclosed: Initial disclosure by reporter
2026-05-26: advisory: NVD publication date
2026-06-05: patched: GitHub Advisory published and fix confirmed in version 2.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.