{"cve":"CVE-2026-47728","nvd":{"published":"2026-05-26T17:16:53.107","modified":"2026-07-24T11:10:00.170","status":"Deferred","description":"Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-862"],"references":["https://github.com/bugsink/bugsink/releases/tag/2.2.0","https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-47728","score":0.00178,"percentile":0.07344,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5389-f7vh-wxj8","url":"https://osv.dev/vulnerability/GHSA-5389-f7vh-wxj8","summary":"Bugsink: Project scoping missing in sourcemap and debug-file lookup","modified":"2026-07-13T16:42:28.363405472Z","packages":[{"ecosystem":"PyPI","name":"bugsink","purl":"pkg:pypi/bugsink","ranges":["<2.2.0"],"fixed":["2.2.0"]}]},{"id":"PYSEC-2026-2402","url":"https://osv.dev/vulnerability/PYSEC-2026-2402","summary":"Bugsink: Project scoping missing in sourcemap and debug-file lookup","modified":"2026-07-13T16:31:39.065919394Z","packages":[{"ecosystem":"PyPI","name":"bugsink","purl":"pkg:pypi/bugsink","ranges":["<2.2.0"],"fixed":["2.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}