TI-2022-07545 Aliases CVE-2022-23485 GHSA-jv85-mqxj-3f9j

Invite code reuse via cookie manipulation in sentry

LOW 29CWE-269Published 2022-12-10 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-284.

Summary

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00451 39th percentileScored 2026-11-07

Fix Fixed sentry (getsentry): 22.11.0sentry (PyPI): 22.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
getsentry	sentry	20.6.0 to before 22.11.0	22.11.0	Patch available	CNA
—	sentry (PyPI)	20.6.0 to before 22.11.0	22.11.0	Patch available	GHSA-jv85-mqxj-3f9j

sentry Vendorgetsentry Affected 20.6.0 to before 22.11.0 Fixed in 22.11.0 Patch available CNA
sentry (PyPI) Vendor— Affected 20.6.0 to before 22.11.0 Fixed in 22.11.0 Patch available GHSA-jv85-mqxj-3f9j

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sentry:sentry::::::::	20.6.0 – 22.10.0	Vulnerable	Sentry

cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:* Versions 20.6.0 – 22.10.0 Vulnerable ·Sentry

Remediation

Fix · CNA sentry (getsentry) Fixed in 22.11.0
Fix · GHSA-jv85-mqxj-3f9j sentry (PyPI) Fixed in 22.11.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23485
2026-10-03 Alias added: GHSA-jv85-mqxj-3f9j

References

Advisory 2

Other 3

TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences