Vulnerability · Published Sep 17, 2024 · Assigned by GitHub_M

CVE-2024-45605Improper authorization on deletion of user issue alert notifications in sentry

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in sentry from getsentry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	sentry	24.9.0	GHSA-54m3-95j9-v89j
PyPI	sentry	24.9.0	PYSEC-2026-1910

Affected products (as reported)

Vendor	Product	Versions
getsentry	sentry	>=23.9.0, < 24.9.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/77093 x_refsource_MISC
https://github.com/getsentry/self-hosted x_refsource_MISC