Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
Sentry SAML SSO allows attackers to take over any user account
CVE-2026-27197
Summary
Versions 21.12.0 through 26.1.0 of Sentry's error tracking and performance monitoring tool have a critical security weakness in its SAML single sign-on feature. This could allow an attacker to gain control of any user account on the same Sentry instance, if multiple organizations are set up and an attacker has access to modify SSO settings for another organization. To protect yourself, users should enable two-factor authentication on their individual accounts.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| sentry | sentry | > 21.12.0 , <= 26.2.0 | – |
Original title
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to...
Original description
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
nvd CVSS3.1
9.1
Vulnerability type
CWE-287
Improper Authentication
- https://github.com/getsentry/sentry/security/advisories/GHSA-ggmg-cqg6-j45g Mitigation Vendor Advisory
Published: 21 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026