{"id":"CVE-2024-45605","aliases":["GHSA-54m3-95j9-v89j","PYSEC-2026-1910"],"title":"Sentry improperly authorizes deletion of user issue alert notifications","summary":"Sentry improperly authorizes deletion of user issue alert notifications","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","vendor":"sentry","product":"sentry","ecosystem":"pip","affected":["sentry >= 23.9.0, < 24.9.0"],"patched":["sentry 24.9.0"],"published":"2024-09-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-54m3-95j9-v89j","references":[{"url":"https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45605"},{"url":"https://github.com/getsentry/sentry/pull/77093"},{"url":"https://github.com/getsentry/sentry/commit/590258255bcb3a5fa4c56f21297b6c99131cfb9d"},{"url":"https://github.com/getsentry/self-hosted"},{"url":"https://github.com/getsentry/sentry"}],"tags":["osv","pip"],"epss":0.00386,"epssPercentile":0.32586,"ingestedAt":"2026-07-08T18:25:45.766Z","slug":"CVE-2024-45605","body":"## Overview\n\n### Impact\nAn authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. \n\n### Patches\nA patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications.\n\nSentry SaaS users do not need to take any action. [Self-Hosted Sentry](https://github.com/getsentry/self-hosted) users should upgrade to version **24.9.0** or higher.\n\n### References\n- [Prevent muting user alerts](https://github.com/getsentry/sentry/pull/77093/)\n\n\n## Affected packages\n\n- `sentry >= 23.9.0, < 24.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sentry 24.9.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}