{"id":"CVE-2023-39349","aliases":["GHSA-9jcq-jf57-c62c","PYSEC-2026-1912"],"title":"Privilege escalation via ApiTokensEndpoint","summary":"Privilege escalation via ApiTokensEndpoint","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","vendor":"sentry","product":"sentry","ecosystem":"pip","affected":["sentry >= 22.1.0, < 23.7.2"],"patched":["sentry 23.7.2"],"published":"2023-08-08","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9jcq-jf57-c62c","references":[{"url":"https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39349"},{"url":"https://github.com/getsentry/sentry/pull/53850"},{"url":"https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083"},{"url":"https://github.com/getsentry/self-hosted/releases/tag/23.7.2"},{"url":"https://github.com/getsentry/sentry"},{"url":"https://github.com/getsentry/sentry/releases/tag/23.7.2"}],"tags":["osv","pip"],"epss":0.01056,"epssPercentile":0.6298,"ingestedAt":"2026-07-08T18:25:48.033Z","slug":"CVE-2023-39349","body":"## Overview\n\n### Impact\nAn attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.\n\nThere is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via `https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/`.\n\n### Patches\nThe issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of [sentry](https://github.com/getsentry/sentry/releases/tag/23.7.2) and [self-hosted](https://github.com/getsentry/self-hosted/releases/tag/23.7.2).\n\n### Workarounds\nThere are no known workarounds.\n\n## Affected packages\n\n- `sentry >= 22.1.0, < 23.7.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sentry 23.7.2`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}