Sentry Weak Authorization Control Vulnerability Allowing Unauthorized Actions on Project Issues

A vulnerability in Sentry versions 25.1.0 through 25.5.1 allows authenticated attackers to perform unauthorized actions on a project's issue endpoint. This includes actions such as adding comments, without being a member of the project's team. The vulnerability requires knowledge of a seven-digit issue ID, which is not confidential and may be publicly available or predictable.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of project issues, such as adding comments without proper authorization.

Reproduction

To reproduce this vulnerability, an authenticated user must access a project's issue endpoint while knowing a valid seven-digit issue ID. The user can then perform unauthorized actions, such as adding comments, without being a member of the project's team.

Remediation

Users are advised to upgrade to Sentry version 25.6.1, which addresses this vulnerability.