Bugsink, a self‑hosted error tracking platform, contains a project‑boundary authorization flaw in versions earlier than 2.2.0. The issue event pages accept a direct event identifier supplied via the URL and retrieve that event without confirming that the event belongs to the issue referenced. Consequently, a user who can access any project can view detailed information—stacktrace, details, and breadcrumbs—about events that belong to other projects if they know the UUID. This flaw is a classic authorization bypass (CWE‑639) and results in confidential error‑tracking data being exposed to unauthorized users.

The vulnerability affects Bugsink installations running any version before 2.2.0; all released versions up to 2.1.x are susceptible.

The CVSS score of 3.1 indicates low overall severity, and the vulnerability is not listed in CISA KEV. No EPSS score is available, suggesting limited evidence of public exploitation. The likely attack vector requires a legitimate authenticated session within Bugsink and knowledge of a cross‑project event UUID, which can be obtained from logs or telemetry. While an attacker can see sensitive stack traces, the flaw does not grant command execution, privileged account creation, or other systemic damage; it is confined to leaking event data that may contain proprietary code or debugging information.