Medium
Sentry CORS misconfiguration vulnerability
Type: advisorySources: OSV
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-36829
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 04:01 UTC · Revision 1
Source evidence
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
osv:CVE-2023-36829
Complete source record
{
"id": "a4939523e43f253dd136f0605a7436ac5c7dca0e506fe67d376c9f699165e9b2",
"url": "https://osv.dev/vulnerability/CVE-2023-36829",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Sentry CORS misconfiguration vulnerability",
"summary": "Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.",
"evidence": "osv:CVE-2023-36829",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-36829",
"aliases": [
"CVE-2023-36829",
"GHSA-4xqm-4p72-87h6",
"PYSEC-2023-115"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getsentry/self-hosted",
"type": "GIT",
"events": [
{
"introduced": "dbded584377d50a2545a98de5d0d53d204b369a0"
},
{
"fixed": "5c5bf06fae3ac6b8c60b4770d4ac985ea670103f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "23.6.0"
},
{
"fixed": "23.6.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "5c5bf06fae3ac6b8c60b4770d4ac985ea670103f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "23.6.2"
},
{
"cpe": "cpe:2.3:a:functional:sentry:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "23.6.0"
},
{
"fixed": "23.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/getsentry/sentry",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ee44c6be35e5e464bc40637580f39867898acd8b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "ee44c6be35e5e464bc40637580f39867898acd8b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"8.1.0",
"8.0.0",
"8.0.0-rc1",
"6.2.3",
"6.2.2",
"6.2.1",
"6.2.0",
"6.1.2",
"6.1.1",
"6.1.0",
"6.0.6",
"6.0.5",
"6.0.4",
"6.0.3",
"6.0.2",
"6.0.1",
"6.0.0",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.1",
"5.2.0",
"5.1.5",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1.2",
"5.1.1.1",
"5.1.1",
"5.1.0",
"4.10.0",
"4.9.8",
"4.9.7.1",
"4.9.7",
"4.9.6",
"4.9.5",
"4.9.4",
"4.9.0",
"4.8.6",
"4.8.5",
"4.8.4",
"4.8.3",
"4.8.2",
"4.8.1",
"4.8.0",
"4.7.7",
"4.7.4",
"4.7.3",
"4.7.2",
"4.7.1",
"4.7.0",
"4.6.0",
"4.5.7",
"4.5.6",
"4.5.5",
"4.5.4",
"4.5.3",
"4.5.2",
"4.5.1",
"4.5.0",
"4.4.6",
"4.4.5",
"4.4.4",
"4.4.3",
"4.4.2",
"4.4.1",
"4.4.0",
"4.3.3",
"4.3.2",
"4.3.1",
"4.3.0",
"4.2.5",
"4.2.4",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.7",
"4.1.6",
"4.1.5",
"4.1.4",
"4.1.3",
"4.1.2",
"4.1.1",
"4.1.0",
"4.0.17",
"4.0.16",
"4.0.15",
"4.0.14",
"4.0.13",
"4.0.12",
"4.0.11",
"4.0.10",
"4.0.9",
"4.0.8",
"4.0.7",
"4.0.6",
"4.0.5",
"4.0.4",
"4.0.3",
"4.0.2",
"4.0.0",
"3.8.1",
"3.8.0",
"3.7.4",
"3.7.3",
"3.7.2",
"3.7.1",
"3.7.0",
"3.6.4",
"3.6.3",
"3.6.2",
"3.6.1",
"3.6.0",
"3.5.9",
"3.5.8",
"3.5.7",
"3.5.6",
"3.5.5",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.0",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.2",
"3.3.1",
"3.3.0",
"3.2.0",
"3.1.4",
"3.1.3",
"3.1.2",
"3.1.1",
"3.1.0",
"3.0.4",
"3.0.3",
"3.0.2",
"3.0.1",
"3.0.0",
"2.9.0",
"1.4.3",
"2.8.1",
"2.8.0",
"2.7.0",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.2",
"2.5.1",
"2.5.0",
"2.4.5",
"2.4.4",
"2.4.3",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.2",
"2.3.1",
"2.3.0",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2.0",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.2",
"2.0.1",
"2.0.0",
"2.0.0-RC9",
"2.0.0-RC7",
"2.0.0-RC5",
"v1.11.3",
"1.11.3",
"v1.11.2",
"1.11.2",
"v1.11.1",
"1.11.1",
"v1.11.0",
"1.11.0",
"v1.10.1",
"1.10.1",
"v1.10.0",
"1.10.0",
"v1.8.8",
"1.8.8",
"v1.7.3",
"1.7.3",
"v1.6.8.1",
"1.6.8.1",
"v1.6.8",
"1.6.8",
"v1.6.7",
"1.6.7",
"v1.6.5",
"1.6.5",
"v1.6.4",
"1.6.4",
"v1.6.2",
"1.6.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36829.json"
}
}
],
"modified": "2026-10-28T02:30:25.901314495Z",
"provider": "osv",
"references": [
"https://github.com/getsentry/self-hosted/releases/tag/23.6.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36829.json",
"https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6",
"https://nvd.nist.gov/vuln/detail/CVE-2023-36829",
"https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b",
"https://github.com/getsentry/sentry/pull/52276"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863",
"CWE-942"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36829.json"
}
},
"related_cves": [
{
"value": "CVE-2023-36829",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492368,
"published_at": "2023-07-06T22:08:58.922+00:00"
}