python · bugsinkHeads-up
Bugsink Fixes Authorization Bypass in Event Lookup
Issue event pages now require the event identifier to belong to the issue in the URL.
What changed
Issue event pages now require the event identifier to belong to the issue in the URL. Direct event lookups require matching both the authorized issue and the project.
Who it affects
Users of Bugsink with access to multiple projects; logged-in users could potentially view event data from another project if they know a valid event UUID.
What to do today
Update Bugsink to the latest version that includes the fix for this authorization issue.
The trail
Collected→
Audited→
Written→
Published