{"cve":"CVE-2026-47716","nvd":{"published":"2026-05-26T17:16:52.957","modified":"2026-07-24T11:10:00.170","status":"Deferred","description":"Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This vulnerability is fixed in 2.2.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","score":3.1},"cwes":["CWE-639"],"references":["https://github.com/bugsink/bugsink/releases/tag/2.2.0","https://github.com/bugsink/bugsink/security/advisories/GHSA-g5vc-q7qc-v939"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-47716","score":0.00147,"percentile":0.03872,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-g5vc-q7qc-v939","url":"https://osv.dev/vulnerability/GHSA-g5vc-q7qc-v939","summary":"Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known","modified":"2026-07-13T16:42:43.934186267Z","packages":[{"ecosystem":"PyPI","name":"bugsink","purl":"pkg:pypi/bugsink","ranges":["<2.2.0"],"fixed":["2.2.0"]}]},{"id":"PYSEC-2026-2406","url":"https://osv.dev/vulnerability/PYSEC-2026-2406","summary":"Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known","modified":"2026-07-13T16:31:39.780689083Z","packages":[{"ecosystem":"PyPI","name":"bugsink","purl":"pkg:pypi/bugsink","ranges":["<2.2.0"],"fixed":["2.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}