{"id":"CVE-2023-39349","aliases":["EUVD-2023-2258","GHSA-9jcq-jf57-c62c","PYSEC-2026-1912"],"status":"published","title":"Sentry vulnerable to privilege escalation via ApiTokensEndpoint","description":"Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01056,"percentile":0.64724,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-287"],"published":"2023-08-07T18:27:12Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"PyPI","package":"sentry","fixed_in":["23.7.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sentry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.0"},{"fixed":"23.7.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"sentry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.0"},{"fixed":"23.7.2"}]}],"versions":["22.1.0","22.10.0","22.11.0","22.12.0","22.2.0","22.3.0","22.4.0","22.5.0","22.6.0","22.7.0","22.8.0","22.9.0","23.1.0","23.1.1","23.2.0","23.3.0","23.3.1","23.4.0","23.5.0","23.5.1","23.5.2","23.6.0","23.6.1","23.6.2","23.7.0","23.7.1"]},{"source":"osv","ecosystem":"PyPI","package":"sentry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.1.0"},{"fixed":"23.7.2"}]}],"versions":["22.1.0","22.10.0","22.11.0","22.12.0","22.2.0","22.3.0","22.4.0","22.5.0","22.6.0","22.7.0","22.8.0","22.9.0","23.1.0","23.1.1","23.2.0","23.3.0","23.3.1","23.4.0","23.5.0","23.5.1","23.5.2","23.6.0","23.6.1","23.6.2","23.7.0","23.7.1"]}],"products":[{"vendor":"getsentry","product":"sentry"},{"vendor":"sentry","product":"sentry"}],"references":[{"url":"https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/getsentry/sentry/pull/53850","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/getsentry/self-hosted/releases/tag/23.7.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/getsentry/sentry/releases/tag/23.7.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39349","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9jcq-jf57-c62c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39349.json","tags":["advisory"]},{"url":"https://github.com/getsentry/sentry","tags":["package"]},{"url":"https://pypi.org/project/sentry","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-39349","title":"Sentry vulnerable to privilege escalation via ApiTokensEndpoint","description":"Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.","status":"published","published":"2023-08-07T18:27:12.396Z","modified":"2024-10-04T19:12:12.595Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-2258","description":"Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.","status":"published","published":"2023-08-07T18:27:12Z","modified":"2024-10-04T19:12:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:49.519503Z"}],"ghsa":[{"id":"GHSA-9jcq-jf57-c62c","title":"Privilege escalation via ApiTokensEndpoint","description":"### Impact\nAn attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.\n\nThere is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via `https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/`.\n\n### Patches\nThe issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of [sentry](https://github.com/getsentry/sentry/releases/tag/23.7.2) and [self-hosted](https://github.com/getsentry/self-hosted/releases/tag/23.7.2).\n\n### Workarounds\nThere are no known workarounds.","status":"published","published":"2023-08-08T20:46:12Z","modified":"2023-11-10T05:01:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-39349","description":"Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.","status":"published","published":"2023-08-07T19:15:11.697Z","modified":"2026-06-17T06:12:06.94Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T14:08:20.798312Z"}],"osv":[{"id":"CVE-2023-39349","title":"Sentry vulnerable to privilege escalation via ApiTokensEndpoint","description":"Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.","status":"published","published":"2023-08-07T18:27:12.396Z","modified":"2026-10-28T02:30:48.082367109Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"GHSA-9jcq-jf57-c62c","title":"Privilege escalation via ApiTokensEndpoint","description":"### Impact\nAn attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.\n\nThere is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via `https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/`.\n\n### Patches\nThe issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of [sentry](https://github.com/getsentry/sentry/releases/tag/23.7.2) and [self-hosted](https://github.com/getsentry/self-hosted/releases/tag/23.7.2).\n\n### Workarounds\nThere are no known workarounds.","status":"published","published":"2023-08-08T20:46:12Z","modified":"2026-07-07T17:57:26.373722891Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"PYSEC-2026-1912","title":"Privilege escalation via ApiTokensEndpoint","description":"### Impact\nAn attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.\n\nThere is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via `https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/`.\n\n### Patches\nThe issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of [sentry](https://github.com/getsentry/sentry/releases/tag/23.7.2) and [self-hosted](https://github.com/getsentry/self-hosted/releases/tag/23.7.2).\n\n### Workarounds\nThere are no known workarounds.","status":"published","published":"2026-07-07T11:45:21.756721Z","modified":"2026-07-07T17:47:52.918461748Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}