# CVE-2026-47716: Bugsink authorization bypass in issue list bulk actions

Source: https://junglewise.ai/threats/cve-2026-47716-bugsink-authorization-bypass-in-issue-list-bulk-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-47716 · Severity: low · CVSS 3.1 · Published 2026-05-26

Bugsink is an error-tracking and issue-management tool. A security flaw in the bulk actions feature allows a logged-in user to modify the status of issues (such as resolving or muting them) in projects they do not have access to. To exploit this, an attacker would need to know the specific unique identifier (UUID) of the target issue, making the practical risk low for most organizations.

Technologies: [Bugsink](https://junglewise.ai/threats/technologies/bugsink), [bugsink (PyPI)](https://junglewise.ai/threats/technologies/pypi-bugsink). Vendors: [Bugsink](https://junglewise.ai/threats/vendors/bugsink), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47716 being exploited in the wild.

**How severe is CVE-2026-47716?** Low severity, with a CVSS score of 3.1, published 26 May 2026.

**Which products and versions are affected?** Bugsink < 2.2.0; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2026-47716?** Yes. bugsink (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47716 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47716?** Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bugsink (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "bugsink>=2.2.0"
  ```


## Technical details

An authorization bypass (CWE-639) exists in Bugsink's issue list bulk action functionality. While the application validates that a user has access to the project specified in the URL, it fails to verify that the individual issue IDs submitted for bulk modification (e.g., resolve, mute) actually belong to that authorized project. An attacker with network access and low-level authentication can modify the state of issues in other projects by providing their UUIDs. The attack complexity is considered high because UUIDs are not easily enumerable or guessable. This issue is resolved in version 2.2.0.

## Affected products

- Bugsink Bugsink < 2.2.0

## Identifiers

- CVE-2026-47716
- GHSA-g5vc-q7qc-v939
- PYSEC-2026-2406

## Timeline

- 2026-05-21: disclosed
- 2026-05-26: advisory: NVD publication date
- 2026-06-05: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/Susen2](https://api.github.com/users/Susen2)
- [https://github.com/Susen2](https://github.com/Susen2)
- [https://api.github.com/users/Susen2/gists%7B/gist_id%7D](https://api.github.com/users/Susen2/gists%7B/gist_id%7D)
- [https://api.github.com/users/Susen2/repos](https://api.github.com/users/Susen2/repos)
- [https://avatars.githubusercontent.com/u/187289153?v=4](https://avatars.githubusercontent.com/u/187289153?v=4)
- [https://api.github.com/users/Susen2/events%7B/privacy%7D](https://api.github.com/users/Susen2/events%7B/privacy%7D)

## Related threats

- [Bugsink denial of service via excessive event tags](https://junglewise.ai/threats/cve-2026-53954-bugsink-denial-of-service-via-excessive-event-tags)
- [PYSEC-2026-1227 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)](https://junglewise.ai/threats/cve-2025-64509-bugsink-is-vulnerable-to-unauthenticated-remote-dos-via-crafted)
- [PYSEC-2026-1225 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input](https://junglewise.ai/threats/cve-2025-64508-bugsink-is-vulnerable-to-unauthenticated-remote-dos-via-crafted)
- [PYSEC-2026-1226 - Bugsink path traversal via event_id in ingestion](https://junglewise.ai/threats/cve-2025-54433-bugsink-path-traversal-via-event-id-in-ingestion)
- [Bugsink missing project scoping in sourcemap and debug file lookup](https://junglewise.ai/threats/cve-2026-47728-bugsink-missing-project-scoping-in-sourcemap-and-debug-file)