Is CVE-2026-47716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47716 being exploited in the wild.

How severe is CVE-2026-47716?

Low severity, with a CVSS score of 3.1, published 26 May 2026.

Which products and versions are affected?

Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

Is there a fix for CVE-2026-47716?

Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47716 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47716?

Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47716: Bugsink authorization bypass in issue list bulk actions

Q: Which products and versions are affected?

Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

Q: Is there a fix for CVE-2026-47716?

Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47716 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47716?

Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47716 · Severity: low · CVSS 3.1 · Published 2026-05-26

Bugsink is an error-tracking and issue-management tool. A security flaw in the bulk actions feature allows a logged-in user to modify the status of issues (such as resolving or muting them) in projects they do not have access to. To exploit this, an attacker would need to know the specific unique identifier (UUID) of the target issue, making the practical risk low for most organizations.

Technologies: Bugsink, bugsink (PyPI). Vendors: Bugsink, PyPI.

Quick answers

Is CVE-2026-47716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47716 being exploited in the wild.
How severe is CVE-2026-47716?: Low severity, with a CVSS score of 3.1, published 26 May 2026.
Which products and versions are affected?: Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.
Is there a fix for CVE-2026-47716?: Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47716 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47716?: Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bugsink (PyPI): upgrade to 2.2.0 or later
```
pip install "bugsink>=2.2.0"
```

Technical details

An authorization bypass (CWE-639) exists in Bugsink's issue list bulk action functionality. While the application validates that a user has access to the project specified in the URL, it fails to verify that the individual issue IDs submitted for bulk modification (e.g., resolve, mute) actually belong to that authorized project. An attacker with network access and low-level authentication can modify the state of issues in other projects by providing their UUIDs. The attack complexity is considered high because UUIDs are not easily enumerable or guessable. This issue is resolved in version 2.2.0.

Affected products

Bugsink Bugsink < 2.2.0

Identifiers

CVE-2026-47716
GHSA-g5vc-q7qc-v939
PYSEC-2026-2406

Timeline

2026-05-21: disclosed
2026-05-26: advisory: NVD publication date
2026-06-05: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.