CVE-2026-47715

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without requiring it to belong to the issue in the URL, enabling a logged-in user with access to one project to view ...

User emails visible in page source

A customer reported that user emails are being included in the page source on issue pages. Even with email visibility set to "Hidden", the reporter and assignee emails are included in the page source. The email is in an attribute called data-user as part of a span tag. Example from this page:...