Executive brief
Bugsink, an error-tracking and log-aggregation tool, failed to properly isolate data between different projects on the same server. An authorized user of one project could potentially view sensitive source code or debugging information belonging to a different project if they knew the specific identification numbers for those files. This issue primarily affects self-hosted installations where multiple internal teams share a single server.
Technical details
A missing authorization check (CWE-862) in Bugsink versions prior to 2.2.0 allowed authenticated users to access sourcemaps and debug-file metadata across project boundaries. The application resolved these files using only a 'debug ID' without verifying that the requesting project owned the metadata. An attacker with access to one project could trigger event processing that references a debug ID from another project, leading to the disclosure of source context or symbolication data. This vulnerability is mitigated in Hosted Bugsink due to tenant isolation but affects self-hosted multi-project instances. The fix in version 2.2.0 introduces proper project scoping for these lookups.
Affected products
- Bugsink Bugsink < 2.2.0
Timeline
- 2026-05-21: disclosed: Initial disclosure by maintainer
- 2026-05-26: advisory: NVD publication date
- 2026-06-05: advisory: GitHub Advisory reviewed and updated