CVE-2026-26004: 
NixOS vulnerability analysis and mitigation

CVE-2026-26004 is a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint that allows authenticated low-privilege users to access event data belonging to other organizations. It affects all Sentry versions prior to 26.1.0. The vulnerability was discovered by GitHub Security Lab's AI agent, reported to Sentry on 2025-12-23, patched on 2026-01-02, and publicly disclosed on 2026-02-20 with CVE assignment by GitHub on 2026-02-10. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (GitHub Security Lab, Feedly).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the GroupEventJsonView.get() method calls get_group_with_redirect(group_id) without passing the active organization parameter, meaning no enforcement exists to verify that the requested group_id belongs to the organization in the URL path (GitHub Security Lab). The authorization model relies on the active organization context for scope checks (event:read), but because the organization is never passed to the group lookup, any authenticated user with event:read in their own organization can substitute an arbitrary group_id from another organization in the URL /organizations/{attacker_org}/issues/{victim_group_id}/events/latest/json/ (GitHub Security Lab). Group IDs are sequential integers, making enumeration straightforward. The fix, merged January 2, 2026, was a single-line change passing organization=organization to get_group_with_redirect (GitHub Commit).

A successful exploit allows an authenticated attacker with only event:read permission in their own organization to read complete event JSON data — including stack traces, request parameters, environment variables, breadcrumbs, and any custom context — from issues belonging to entirely separate organizations. This results in a high confidentiality impact with no integrity or availability impact. The scope is limited to the Sentry instance itself, but in multi-tenant or SaaS deployments, this could expose sensitive application error data, internal infrastructure details, or secrets inadvertently captured in error events across all organizations on the platform (GitHub Security Lab, Feedly).

A proof-of-concept exploit is publicly available via the GitHub Security Lab advisory, demonstrating exploitation with a simple authenticated curl request (GitHub Security Lab). The CVSS v4.0 exploit maturity is rated "Proof of Concept." The EPSS score is approximately 0.036%, indicating low current automated exploitation probability. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain authenticated access: Register or log in as a low-privilege user (member role with event:read scope) in any organization on the target Sentry instance (attacker's own organization, e.g., attackerorg).
2. Enumerate victim group IDs: Since Sentry group/issue IDs are sequential integers, enumerate IDs by incrementing or decrementing from known group IDs visible in the attacker's own organization to identify IDs belonging to other organizations.
3. Craft the malicious request: Construct a GET request substituting the victim's group_id while using the attacker's own organization slug in the URL path:

   curl -X GET '/organizations/attackerorg/issues/{victim_group_id}/events/latest/json/' \
     -H 'Cookie: sentrysid=<attacker_session_cookie>' \
     -H 'Accept: application/json'

4. Receive victim event data: The server returns the full JSON event payload from the victim organization, including stack traces, request data, environment variables, breadcrumbs, and custom context, without any authorization error (GitHub Security Lab).

• Network: HTTP GET requests to /organizations/{org_slug}/issues/{group_id}/events/latest/json/ or /organizations/{org_slug}/issues/{group_id}/events/{event_id}/json/ where the group_id does not belong to the organization in the URL slug; sequential or rapid enumeration of group IDs from a single authenticated session.
• Logs: Sentry access logs showing a single user/session making repeated requests to the GroupEventJsonView endpoint with varying group_id values across a short time window; HTTP 200 responses to cross-organization issue event JSON endpoints from users not affiliated with the owning organization.
• Application Behavior: Authenticated API activity from a user account accessing event data for issues not associated with their own organization's projects (GitHub Security Lab).

Upgrade Sentry to version 26.1.0 or later, which includes the fix that passes the organization parameter to get_group_with_redirect, enforcing proper organizational boundary checks (GitHub PR, GitHub Commit). Sentry Cloud (sentry.io) was patched on January 2, 2026; self-hosted deployments must upgrade manually. No configuration-based workaround is available — upgrading to 26.1.0 is the only remediation.

The vulnerability was discovered by an AI agent developed by GitHub Security Lab and reviewed by GHSL team members Man Yue Mo and Peter Stöckli, highlighting the growing role of automated security tooling in vulnerability research (GitHub Security Lab). Sentry initially fixed the issue on January 2, 2026 without issuing a CVE or public advisory; GitHub Security Lab subsequently assigned CVE-2026-26004 and published the advisory on February 20, 2026 after the coordinated disclosure period. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking.