Executive brief
Bugsink is an error-tracking and issue-management tool. A security flaw in the bulk actions feature allows a logged-in user to modify the status of issues (such as resolving or muting them) in projects they do not have access to. To exploit this, an attacker would need to know the specific unique identifier (UUID) of the target issue, making the practical risk low for most organizations.
Technical details
An authorization bypass (CWE-639) exists in Bugsink's issue list bulk action functionality. While the application validates that a user has access to the project specified in the URL, it fails to verify that the individual issue IDs submitted for bulk modification (e.g., resolve, mute) actually belong to that authorized project. An attacker with network access and low-level authentication can modify the state of issues in other projects by providing their UUIDs. The attack complexity is considered high because UUIDs are not easily enumerable or guessable. This issue is resolved in version 2.2.0.
Affected products
- Bugsink Bugsink < 2.2.0
Timeline
- 2026-05-21: disclosed
- 2026-05-26: advisory: NVD publication date
- 2026-06-05: patched: GitHub Advisory reviewed and updated