CVE-2026-47728: Bugsink Project Scoping Vulnerability Leading to Cross-Project Data Exposure
Summary
CVE-2026-47728: Bugsink: Project scoping missing in sourcemap and debug-file lookup. Affects bugsink versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bugsink is a tool designed for error tracking and monitoring in software applications. It allows developers to upload and manage sourcemaps and debug files to facilitate better error reporting and debugging. The package is widely used in various development environments, but it has a critical vulnerability that affects how it handles project scoping for uploaded metadata, potentially leading to unauthorized access to sensitive information across different projects within the same Bugsink instance.
Vulnerability Detail
The vulnerability arises from Bugsink's handling of sourcemaps and debug files, where it resolves these files by debug ID without properly scoping the lookup to the project that owns the uploaded metadata. An authenticated user with access to one project could exploit this flaw to cause event processing in that project to use sourcemap or debug-file metadata uploaded for another project, if the same debug ID is referenced. This could lead to the disclosure of source context or symbolication-derived context from another project, posing a significant risk to data privacy and security.
How To Fix
Latest published version: 2.6.2 as of 23 Oct 2026
pip install --upgrade "bugsink==2.6.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
pip install --upgrade "bugsink==2.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To immediately remove legacy projectless sourcemap metadata after upgrading, run the following command: 'bugsink-manage delete_legacy_sourcemaps'. This will help mitigate any risks associated with previously uploaded sourcemaps that do not have proper project scoping.
Conclusion
The Bugsink vulnerability CVE-2026-47728 highlights a critical issue in project scoping for sourcemaps and debug files, allowing potential cross-project data exposure. Users are strongly advised to upgrade to version 2.2.0 or later to mitigate this risk and ensure proper project boundaries are maintained.
See every vulnerability recorded for bugsink →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Bugsink versions 2.1.3 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider using the workaround to delete legacy sourcemaps and ensure that new uploads are scoped correctly.
Yes, the practical impact is limited to self-hosted instances, as Hosted Bugsink uses separate instances per tenant, preventing cross-tenant data exposure.
Related vulnerabilities
Recent vulnerabilities recorded for bugsink.
