CVE-2023-36829Medium· 6.8▾ SunlitSentry CORS misconfiguration
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default.
Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.
The patch has been released in Sentry 23.6.2.
For Sentry SaaS customers, no action is needed.
For self-hosted Sentry installations that have system.base-hostname explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.
sentry >= 23.6.0, < 23.6.2Upgrade to a patched release:
sentry 23.6.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27197Critical· 9.1Sentry: Improper authentication on SAML SSO process allows user identity linking
CVE-2023-36826High· 7.7Improper authorization on debug and artifact file downloads
CVE-2024-45606High· 7.1Sentry improperly authorizes muting of alert rules
CVE-2023-39531Medium· 6.5Sentry vulnerable to incorrect credential validation on OAuth token requests
CVE-2024-41656High· 7.1Sentry vulnerable to stored Cross-Site Scripting (XSS)
CVE-2024-35196Low· 2.0Slack integration leaks sensitive information in logs