A vulnerability in Bugsink allows a user who can view the issue list to issue bulk changes that are applied to any issue IDs supplied, regardless of whether those issues belong to the project specified in the URL. This lack of ownership validation permits an attacker to alter, close, or otherwise modify issues in projects whose UUIDs are known, leading to unauthorized data modification. The weakness is an authorization flaw identified as CWE‑639.

All self‑hosted Bugsink installations running any version older than 2.2.0 are affected. The bug is located in the issue list view component that authorizes project‑level access but does not enforce project membership on the submitted bulk‑action payload.

The CVSS score of 3.1 indicates a low overall impact. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, there is no evidence of widespread exploitation. However, an attacker who knows a target project’s UUID and can authenticate to the Bugsink instance can exploit the flaw remotely via the web interface by sending a crafted bulk‑action request. The attack requires only legitimate access to the issue list view and knowledge of the target UUID, making it potentially valuable in environments where multiple projects coexist.