Read the docs
TI-2023-18620 Aliases CVE-2023-36826GHSA-m4hc-m2v6-hfw8

Sentry vulnerable to improper authorization on debug and artifact file downloads

Priority LOW 35CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00634 50th percentileScored 2026-11-07
Fix Fixed sentry (getsentry): 23.5.2sentry (PyPI): 23.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysentry8.21.0 to before 23.5.223.5.2Patch availableCNA
—sentry (PyPI)8.21.0 to before 23.5.223.5.2Patch availableGHSA-m4hc-m2v6-hfw8
  • sentry Vendorgetsentry Affected 8.21.0 to before 23.5.2 Fixed in 23.5.2 Patch available CNA
  • sentry (PyPI) Vendor— Affected 8.21.0 to before 23.5.2 Fixed in 23.5.2 Patch available GHSA-m4hc-m2v6-hfw8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*8.21.0 to before 23.5.2VulnerableSentry
  • cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:* Versions 8.21.0 to before 23.5.2 Vulnerable ·Sentry

Remediation

  • Fix · CNA sentry (getsentry) Fixed in 23.5.2
  • Fix · GHSA-m4hc-m2v6-hfw8 sentry (PyPI) Fixed in 23.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36826
  2. 2026-10-03 Alias added: GHSA-m4hc-m2v6-hfw8
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 2

Other 2

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences