Executive brief
Bugsink, an error-tracking and log-aggregation tool, contains a flaw where a logged-in user can view error event data from projects they are not authorized to access. To exploit this, an attacker must already know the specific unique identifier (UUID) of the target event, which is difficult to guess. While this could lead to the exposure of sensitive technical data like stack traces, the risk is limited in environments where Bugsink is self-hosted or isolated per tenant.
Technical details
Bugsink is vulnerable to an authorization bypass (CWE-639) in its issue event pages, including stacktrace, details, and breadcrumbs views. The application accepts a direct event UUID from the URL but fails to verify that the requested event belongs to the project or issue the user is authorized to view. An authenticated attacker with network access can view cross-project event data if they possess a valid target event UUID. The vulnerability is mitigated by the high complexity of guessing UUIDs and the typical deployment model of separate instances per tenant. The issue is fixed in version 2.2.0 by enforcing that event lookups match both the authorized issue and project.
Affected products
- bugsink bugsink < 2.2.0
Timeline
- 2026-05-21: disclosed: Initial disclosure by reporter
- 2026-05-26: advisory: NVD publication date
- 2026-06-05: patched: GitHub Advisory published and fix confirmed in version 2.2.0