https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:24:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-27197 <p><strong>Affected:</strong> getsentry sentry</p> <p>Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim&#39;s user account. Organization administrators cannot do this on a user&#39;s behalf, this requires individual users to ensure 2FA has been enabled for their account.</p> <p><strong>Affected:</strong> getsentry sentry</p> <p>Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim&#39;s user account. Organization administrators cannot do this on a user&#39;s behalf, this requires individual users to ensure 2FA has been enabled for their account.</p> https://cve.radiocsirt.org/vuln/cve-2026-27197 https://cve.radiocsirt.org/vuln/ghsa-ggmg-cqg6-j45g <p><strong>Affected:</strong> PyPI: sentry</p> <p>### Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.</p> <p>The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.</p> <p>For self-hosted users, you are only vulnerable if the following conditions are met: - You have more than one organization configured (SENTRY_SINGLE_ORGANIZATION = False). - A malicious user has existing access and permissions to modify SSO settings for another organization in your multo-organization instance.</p> <p>### Patches - [Sentry SaaS](https://sentry.io/): The fix was deployed on February 18, 2026. No action is required. - [Self-Hosted Sentry](https://github.com/getsentry/self-hosted): If only a single organization is allowed (SENTRY_SINGLE_ORGANIZATION = True), then no action is needed. We recommend upgrading to version 26.2.0 or higher.</p> <p>### Workarounds User account-based two-factor authentication prevents an attacker from being able to complete authentication with a victim&#39;s user account. Organization administrators cannot do this on a user&#39;s behalf, this requires individual users to ensure 2FA has been enabled for their account.</p> <p>You can manage your two-factor authentication settings on your Account Settings &gt; [Security](https://sentry.io/settings/account/security/) page. For st…</p> <p><strong>Affected:</strong> PyPI: sentry</p> <p>### Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.</p> <p>The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.</p> <p>For self-hosted users, you are only vulnerable if the following conditions are met: - You have more than one organization configured (SENTRY_SINGLE_ORGANIZATION = False). - A malicious user has existing access and permissions to modify SSO settings for another organization in your multo-organization instance.</p> <p>### Patches - [Sentry SaaS](https://sentry.io/): The fix was deployed on February 18, 2026. No action is required. - [Self-Hosted Sentry](https://github.com/getsentry/self-hosted): If only a single organization is allowed (SENTRY_SINGLE_ORGANIZATION = True), then no action is needed. We recommend upgrading to version 26.2.0 or higher.</p> <p>### Workarounds User account-based two-factor authentication prevents an attacker from being able to complete authentication with a victim&#39;s user account. Organization administrators cannot do this on a user&#39;s behalf, this requires individual users to ensure 2FA has been enabled for their account.</p> <p>You can manage your two-factor authentication settings on your Account Settings &gt; [Security](https://sentry.io/settings/account/security/) page. For st…</p> https://cve.radiocsirt.org/vuln/ghsa-ggmg-cqg6-j45g