CVE-2023-39349highCWE-284CWE-287

CVE-2023-39349: high-severity vulnerability in getsentry sentry

Sentry vulnerable to privilege escalation via ApiTokensEndpoint

Published · Updated

Follow this CVE+ Monitor sentry+ Monitor sentry

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.1%
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
getsentry · sentry
Related CVEs — getsentry sentry

In the same product, most dangerous first.

CVE-2025-53099MEDIUMSentry Missing Invalidation of Authorization Codes During OAuth Exchange and RevocationEPSS 0.8%CVE-2023-36829MEDIUMSentry CORS misconfiguration vulnerabilityEPSS 0.7%CVE-2024-53253MEDIUMSentry's improper error handling leaks Application Integration Client SecretEPSS 0.6%CVE-2023-36826HIGHSentry vulnerable to improper authorization on debug and artifact file downloadsEPSS 0.6%CVE-2026-42354CRITICALSentry: Improper authentication on SAML SSO process allows user identity linkingEPSS 0.6%CVE-2025-22146CRITICALImproper authentication on SAML SSO process allows user impersonation in sentryEPSS 0.6%