Read the docs
TI-2024-30625 Aliases CVE-2024-45606GHSA-v345-w9f2-mpm5

Improper authorization on muting of alert rules in sentry

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix Fixed sentry (getsentry): 24.9.0sentry (PyPI): 24.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysentry23.4.0 to before 24.9.024.9.0Patch availableCNA
—sentry (PyPI)23.4.0 to before 24.9.024.9.0Patch availableGHSA-v345-w9f2-mpm5
  • sentry Vendorgetsentry Affected 23.4.0 to before 24.9.0 Fixed in 24.9.0 Patch available CNA
  • sentry (PyPI) Vendor— Affected 23.4.0 to before 24.9.0 Fixed in 24.9.0 Patch available GHSA-v345-w9f2-mpm5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*23.4.0 to before 24.9.0VulnerableSentry
  • cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:* Versions 23.4.0 to before 24.9.0 Vulnerable ·Sentry

Remediation

  • Fix · CNA sentry (getsentry) Fixed in 24.9.0
  • Fix · GHSA-v345-w9f2-mpm5 sentry (PyPI) Fixed in 24.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45606
  2. 2026-10-03 Alias added: GHSA-v345-w9f2-mpm5

References

Patch 1

Advisory 2

Other 3

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences