CVE-2026-26004 Sentry allows unauthorized access to event data across organizational boundaries
Attackers can access event data across organizational boundaries via an IDOR vulnerability in Sentry's GroupEventJsonView endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26004?
CVE-2026-26004 is a medium-severity missing authorization vulnerability in getsentry sentry, published on 17 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.
Weakness: CWE-639
Which versions are affected by CVE-2026-26004?
It affects 1 product.
Products include Sentry Sentry.
How do I fix CVE-2026-26004?
No fix has been published for CVE-2026-26004 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-26004 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26004 exists.
Other vulnerabilities in getsentry sentry
- CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
- CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint
- CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads