An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via Sentry's private bug bounty program.
The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.
Self-hosted users are only vulnerable if the following conditions are met: - They have more than one organization configured (SENTRYSINGLEORGANIZATION = False). - A malicious user has existing access and permissions to modify SSO settings for another organization in their multi-organization instance.
Patches - Sentry SaaS: The fix was deployed in April. No action is required. - Self-Hosted Sentry: If only a single organization is allowed (SENTRYSINGLEORGANIZATION = True), then no action is needed. Sentry recommends upgrading to version 26.4.1 or higher.
Workarounds User account-based two-factor authentication prevents an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
Users can manage their two-factor authentication settings through Account Settings > Security page. For step-by-step details, please see the Sentry helpdesk article.
Resources
- https://github.com/getsentry/sentry/pull/113720
Please note that this is distinct vulnerability from the similar https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w from 2025.
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.
Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time. This vulnerability is fixed in 26.5.2.
Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. One of such integrations, the Phabricator integration (maintained by Sentry) with version <=24.1.1 contains a constrained SSRF vulnerability. An attacker could make Sentry send POST HTTP requests to arbitrary URLs (including internal IP addresses) by providing an unsanitized input to the Phabricator integration. However, the body payload is constrained to a specific format. If an attacker has access to a Sentry instance, this allows them to: 1. interact with internal network; 2. scan local/remote ports. This issue has been fixed in Sentry self-hosted release 24.1.2, and has already been mitigated on sentry.io on February 8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.
The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.
For self-hosted users, you are only vulnerable if the following conditions are met: - You have more than one organization configured (SENTRYSINGLEORGANIZATION = False). - A malicious user has existing access and permissions to modify SSO settings for another organization in your multo-organization instance.
Patches - Sentry SaaS: The fix was deployed on February 18, 2026. No action is required. - Self-Hosted Sentry: If only a single organization is allowed (SENTRYSINGLEORGANIZATION = True), then no action is needed. We recommend upgrading to version 26.2.0 or higher.
Workarounds User account-based two-factor authentication prevents an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
You can manage your two-factor authentication settings on your Account Settings > Security page. For step-by-step details, please see our helpdesk article.
A cross-organization Insecure Direct Object Reference (IDOR) vulnerability has been identified in Sentry’s GroupEventJsonView endpoint.
A cross-organization Insecure Direct Object Reference (IDOR) vulnerability has been identified in Sentry’s GroupEventJsonView endpoint.