CVE-2026-47728: Bugsink: Project scoping missing in sourcemap and debug-file lookup

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-07-24
Weakness: CWE-862

Description

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.

Affected products

bugsink: before 2.2.0

References

https://github.com/bugsink/bugsink/releases/tag/2.2.0
https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8

Get alerted when CVE-2026-47728 or the next vulnerability affects your stack