VulnerabilityDeferred

CVE-2026-47728

This vulnerability is fixed in 2.2.0.

MEDIUM 4.3EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.18% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: security-advisories@github.com

References

https://github.com/bugsink/bugsink/releases/tag/2.2.0
https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.