# CVE-2026-47715: Bugsink authorization bypass in issue event views

Source: https://junglewise.ai/threats/cve-2026-47715-bugsink-authorization-bypass-in-issue-event-views  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-47715 · Severity: low · CVSS 3.1 · Published 2026-05-26

Bugsink, an error-tracking and log-aggregation tool, contains a flaw where a logged-in user can view error event data from projects they are not authorized to access. To exploit this, an attacker must already know the specific unique identifier (UUID) of the target event, which is difficult to guess. While this could lead to the exposure of sensitive technical data like stack traces, the risk is limited in environments where Bugsink is self-hosted or isolated per tenant.

Technologies: [Bugsink](https://junglewise.ai/threats/technologies/bugsink), [bugsink (PyPI)](https://junglewise.ai/threats/technologies/pypi-bugsink). Vendors: [Bugsink](https://junglewise.ai/threats/vendors/bugsink), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47715 being exploited in the wild.

**How severe is CVE-2026-47715?** Low severity, with a CVSS score of 3.1, published 26 May 2026.

**Which products and versions are affected?** Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2026-47715?** Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47715 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47715?** Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bugsink (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "bugsink>=2.2.0"
  ```


## Technical details

Bugsink is vulnerable to an authorization bypass (CWE-639) in its issue event pages, including stacktrace, details, and breadcrumbs views. The application accepts a direct event UUID from the URL but fails to verify that the requested event belongs to the project or issue the user is authorized to view. An authenticated attacker with network access can view cross-project event data if they possess a valid target event UUID. The vulnerability is mitigated by the high complexity of guessing UUIDs and the typical deployment model of separate instances per tenant. The issue is fixed in version 2.2.0 by enforcing that event lookups match both the authorized issue and project.

## Affected products

- bugsink bugsink < 2.2.0

## Identifiers

- CVE-2026-47715
- GHSA-vx2f-6m6h-9frf
- PYSEC-2026-2407

## Timeline

- 2026-05-21: disclosed: Initial disclosure by reporter
- 2026-05-26: advisory: NVD publication date
- 2026-06-05: patched: GitHub Advisory published and fix confirmed in version 2.2.0

## References

- [https://api.github.com/users/nuiifornet](https://api.github.com/users/nuiifornet)
- [https://github.com/nuiifornet](https://github.com/nuiifornet)
- [https://api.github.com/users/nuiifornet/gists%7B/gist_id%7D](https://api.github.com/users/nuiifornet/gists%7B/gist_id%7D)
- [https://api.github.com/users/nuiifornet/repos](https://api.github.com/users/nuiifornet/repos)
- [https://avatars.githubusercontent.com/u/121714348?v=4](https://avatars.githubusercontent.com/u/121714348?v=4)
- [https://api.github.com/users/nuiifornet/events%7B/privacy%7D](https://api.github.com/users/nuiifornet/events%7B/privacy%7D)

## Related threats

- [Bugsink denial of service via excessive event tags](https://junglewise.ai/threats/cve-2026-53954-bugsink-denial-of-service-via-excessive-event-tags)
- [PYSEC-2026-1227 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)](https://junglewise.ai/threats/cve-2025-64509-bugsink-is-vulnerable-to-unauthenticated-remote-dos-via-crafted)
- [PYSEC-2026-1225 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input](https://junglewise.ai/threats/cve-2025-64508-bugsink-is-vulnerable-to-unauthenticated-remote-dos-via-crafted)
- [PYSEC-2026-1226 - Bugsink path traversal via event_id in ingestion](https://junglewise.ai/threats/cve-2025-54433-bugsink-path-traversal-via-event-id-in-ingestion)
- [Bugsink missing project scoping in sourcemap and debug file lookup](https://junglewise.ai/threats/cve-2026-47728-bugsink-missing-project-scoping-in-sourcemap-and-debug-file)