UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39349

Privilege escalation via ApiTokensEndpoint

Severity
High 8.1
Published
7 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
23.7.2
Also known as
GHSA-9jcq-jf57-c62c
Sources
NVD, Project advisories (GitHub)

Description

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`.…

Affected software

SoftwareAffected versions
SentryServers and applications · cpe:a:sentry:sentry
  • From 22.1.0 before 23.7.2
SentryServers and applications · github:getsentry/sentry
  • From 22.1.0 before 23.7.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39349
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39349
  • GitHub Advisory Database https://github.com/advisories/GHSA-9jcq-jf57-c62c
  • github.com https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c