Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-crnn-rr9n-hkf5
Vulnerability ID VCID-crnn-rr9n-hkf5
Aliases CVE-2023-36826
GHSA-m4hc-m2v6-hfw8
PYSEC-2023-130
Summary Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-285 Improper Authorization
CWE-863 Incorrect Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00186 https://api.first.org/data/v1/epss?cve=CVE-2023-36826
cvssv3.1 7.7 https://github.com/getsentry/sentry
cvssv4 8.3 https://github.com/getsentry/sentry
generic_textual HIGH https://github.com/getsentry/sentry
cvssv3.1 6.5 https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
cvssv3.1 7.7 https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
cvssv4 8.3 https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
generic_textual HIGH https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
ssvc Track https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
cvssv3.1 6.5 https://github.com/getsentry/sentry/pull/49680
cvssv3.1 7.7 https://github.com/getsentry/sentry/pull/49680
cvssv4 8.3 https://github.com/getsentry/sentry/pull/49680
generic_textual HIGH https://github.com/getsentry/sentry/pull/49680
ssvc Track https://github.com/getsentry/sentry/pull/49680
cvssv3.1 6.5 https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
cvssv3.1 7.7 https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
cvssv4 8.3 https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
generic_textual HIGH https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
ssvc Track https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
cvssv3.1 7.7 https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
cvssv4 8.3 https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
cvssv3.1 7.7 https://nvd.nist.gov/vuln/detail/CVE-2023-36826
cvssv4 8.3 https://nvd.nist.gov/vuln/detail/CVE-2023-36826
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-36826
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-36826
https://github.com/getsentry/sentry
https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
https://nvd.nist.gov/vuln/detail/CVE-2023-36826
49680 https://github.com/getsentry/sentry/pull/49680
e932b15435bf36239431eaa3790a6bcfa47046a9 https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
GHSA-m4hc-m2v6-hfw8 https://github.com/advisories/GHSA-m4hc-m2v6-hfw8
GHSA-m4hc-m2v6-hfw8 https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/getsentry/sentry
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/getsentry/sentry
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-03T19:25:05Z/ Found at https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/pull/49680
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/pull/49680
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/getsentry/sentry/pull/49680
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-03T19:25:05Z/ Found at https://github.com/getsentry/sentry/pull/49680
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-03T19:25:05Z/ Found at https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-36826
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-36826
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.40327
EPSS Score 0.00186
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:23:07.632762+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/36xxx/CVE-2023-36826.json 38.6.0