CVE-2025-53073

Description

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) without being a member of the project's team. A seven-digit issue ID must be known (it is not treated as a secret and might be mentioned publicly, or it could be predicted).

PUBLISHED Reserved 2025-06-24 | Published 2025-06-24 | Updated 2025-06-24 | Assigner mitre

Problem types

CWE-425 Direct Request ('Forced Browsing')

Product status

References

github.com/nikolas-ch/CVEs/tree/main/Sentry_Version>=25.1.0

github.com/...0/Sentry_>=25.1.0_WeakAuthorizationControl.txt

github.com/getsentry/self-hosted/releases

cve.org (CVE-2025-53073)

nvd.nist.gov (CVE-2025-53073)

Download JSON