Sentry’s GroupEventJsonView endpoint is vulnerable to an Insecure Direct Object Reference, allowing an authenticated user to retrieve event data belonging to other organizations. This IDOR flaw leads to unauthorized access to potentially sensitive error and performance information, compromising confidentiality across organizational boundaries. The vulnerability is classified as CWE‑639.

The issue affects all Sentry instances released before version 26.1.0. The affected vendor is getsentry, and the product is Sentry error tracking and performance monitoring. Version 26.1.0 and later contain a patch that removes the vulnerable endpoint behavior.

The CVSS score of 5.7 indicates a moderate risk, and the EPSS score is negligible (<1 %). The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires possession of an authenticated account within one organization; the attacker can then request event data for other organizations through the compromised endpoint. No additional escalation or privileges are required beyond normal user access, but the impact spans across all organizations using a shared Sentry deployment.