Bugsink’s sourcemap and debug-file resolution was performed without scoping the lookup to the project that uploaded the metadata. An authenticated user who can view events in one project could trigger the processing of an event that references a debug ID that also exists for another project. The lookup would then use the debug metadata from that other project, potentially exposing internal source code or debugging information that the original project owner did not intend to share. This flaw maps to CWE‑862: Privilege Bypass Through User-Controlled Key.

The vulnerability affects all Bugsink installations running a version prior to 2.2.0. Any Bugsink instance that hosts multiple projects and allows users to upload sourcemaps or debug files is vulnerable unless the offending version is upgraded.

With a CVSS score of 4.3 the risk is medium. The EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation so far. Exploitation requires an authenticated session with permissions on at least one project and the presence of a duplicate debug ID in another project. The attack is local to the application and does not involve remote code execution or broad privilege escalation. The most likely attack vector is an authenticated user integrating malicious or sensitive debug metadata from another project into event processing.