Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
Priority LOW 14CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This vulnerability is fixed in 2.2.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00147 3rd percentileScored 2026-11-07
Fix Fixed bugsink (bugsink): 2.2.0bugsink (PyPI): 2.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bugsink | bugsink | before 2.2.0 | 2.2.0 | Patch available | CNA |
| — | bugsink (PyPI) | before 2.2.0 | 2.2.0 | Patch available | GHSA-g5vc-q7qc-v939 |
- bugsink Vendorbugsink Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA
- bugsink (PyPI) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-g5vc-q7qc-v939
Remediation
- Fix · CNA bugsink (bugsink) Fixed in 2.2.0
- Fix · GHSA-g5vc-q7qc-v939 bugsink (PyPI) Fixed in 2.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47716
- 2026-10-03 Alias added: GHSA-g5vc-q7qc-v939
References
More bugsink vulnerabilities
- TI-2026-22000 Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering CVSS 3.1CRITICAL 9.3
- TI-2025-39901 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) CVSS 3.1HIGH 7.5
- TI-2025-39900 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input CVSS 3.1HIGH 7.5
- TI-2025-34236 Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion CVSS 4.0HIGH 7.2
- TI-2026-28977 Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble CVSS 3.1HIGH 7.1
- TI-2026-38922 Bugsink: DOS using large numbers of event tags CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-47716 · CVE Program
- CVE-2026-47716 · NVD
- FIRST EPSS
- GHSA-g5vc-q7qc-v939 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences