{"id":"CVE-2023-36829","aliases":["GHSA-4xqm-4p72-87h6","PYSEC-2023-115"],"title":"Sentry CORS misconfiguration","summary":"Sentry CORS misconfiguration","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","vendor":"sentry","product":"sentry","ecosystem":"pip","affected":["sentry >= 23.6.0, < 23.6.2"],"patched":["sentry 23.6.2"],"published":"2023-07-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:08.444402599Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4xqm-4p72-87h6","references":[{"url":"https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36829"},{"url":"https://github.com/getsentry/sentry/pull/52276"},{"url":"https://github.com/getsentry/sentry/commit/19248fb9802c252665b802aeab02fdc65ed47dc9"},{"url":"https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b"},{"url":"https://github.com/getsentry/self-hosted/releases/tag/23.6.2"},{"url":"https://github.com/getsentry/sentry"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-115.yaml"}],"tags":["osv","pip"],"epss":0.00666,"epssPercentile":0.50378,"ingestedAt":"2026-09-12T03:13:01.656Z","slug":"CVE-2023-36829","body":"## Overview\n\n### Impact\nThe Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default.\n\nImpact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.\n\n### Patches\nThe patch has been released in [Sentry 23.6.2](https://github.com/getsentry/self-hosted/releases/tag/23.6.2).\n\n### Workarounds\n\nFor Sentry SaaS customers, no action is needed.\n\nFor self-hosted Sentry installations that have `system.base-hostname` explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.\n\n### References\n- [getsentry/sentry PR #52276](https://github.com/getsentry/sentry/pull/52276)\n\n### Credits\n- [@andr0idp4r4n0id](https://twitter.com/andr0idp4r4n0id)\n\n## Affected packages\n\n- `sentry >= 23.6.0, < 23.6.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sentry 23.6.2`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}