CVE-2023-36829

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

• CWE-863
• CWE-942
• CWE-697

• https://github.com/getsentry/self-hosted/releases/tag/23.6.2Release Notes
• https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8bPatch
• https://github.com/getsentry/sentry/pull/52276Patch
• https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6Patch
• https://github.com/getsentry/self-hosted/releases/tag/23.6.2Release Notes
• https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8bPatch
• https://github.com/getsentry/sentry/pull/52276Patch
• https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6Patch

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36823Sanitize is an allowlist-based HTML and CSS sanitizer. Using…6.1
• CVE-2023-36824Redis is an in-memory database that persists on disk. In Red…8.8
• CVE-2023-36825Orchid is a Laravel package that allows application developm…9.8
• CVE-2023-36826Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2023-36827Fides is an open-source privacy engineering platform for man…7.5
• CVE-2023-36828Statamic is a flat-first, Laravel and Git powered content ma…5.4
• CVE-2023-3683A vulnerability has been found in LivelyWorks Articart 2.0.1…5.4
• CVE-2023-36830SQLFluff is a SQL linter. Prior to version 2.1.2, in environ…7.8
• CVE-2023-36831An Improper Check or Handling of Exceptional Conditions vuln…7.5
• CVE-2023-36832An Improper Handling of Exceptional Conditions vulnerability…7.5
• CVE-2023-36833A Use After Free vulnerability in the packet forwarding engi…6.5
• CVE-2023-36834An Incomplete Internal State Distinction vulnerability in th…6.5