CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Attackers with low-scope tokens can list and use high-scope tokens, enabling privilege escalation and unauthorized data access in Sentry.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39349?
CVE-2023-39349 is a high-severity missing authorization vulnerability in getsentry sentry, published on 7 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
Which versions are affected by CVE-2023-39349?
3 open source packages ship an affected version, including sentry. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sentry PyPI | From 22.1.0 | 23.7.2 |
sentry PyPI | From 22.1.0 | 23.7.2 |
sentry PyPI | From 22.1.0 | 23.7.2 |
Products include Sentry Sentry.
How do I fix CVE-2023-39349?
Upgrade sentry to 23.7.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-39349 being exploited?
There is no known exploitation of CVE-2023-39349 in the wild and no public exploit code.
Other vulnerabilities in getsentry sentry
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
- CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads
- CVE-2026-52794 Sentry: Inefficient Regular Expression Complexity in sentry
Sources
Also known as GHSA-9jcq-jf57-c62c, PYSEC-2026-1912.