Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Sentry allows logged‑in users to delete other users’ alerts

CVE-2024-45605 · published 2 years ago
Summary

In Sentry, a logged‑in user could remove alert notifications that belong to any other user if they know the alert’s ID. This could hide important error notifications from the affected users. SaaS customers do not need to change anything, but anyone running Sentry on their own servers should upgrade to version 24.9.0 or later as soon as possible.

What to do
  • Update sentry sentry to version 24.9.0.
Affected software
Ecosystem VendorProductAffected versions
pip sentry sentry >= 23.9.0, < 24.9.0
Fix: upgrade to 24.9.0
– sentry sentry >= 23.9.0, < 24.9.0
cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*
Original advisory text
Improper authorization on deletion of user issue alert notifications in sentry
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published17 Sep 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-54m3-95j9-v89j · GHSA
CVE-2024-45605 · NVD
CVE-2024-45605 · OSV
Track software like this
Free during beta