Low severity · published Dec 10, 2022
CVE-2022-23485
Invite code reuse via cookie manipulation in sentry
3.7
CVSS
0.5%
EPSS
No
On KEV
Description
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
sentry · getsentry
>= 20.6.0, < 22.11.0 · source: vendor, NVD
Affected product
SE
sentry
getsentry
More from sentry
9.8
CVE-2026-42354
Sentry: Improper authentication on SAML SSO process allows user identity linking
9.1
CVE-2026-27197
Sentry: Improper Authentication on SAML SSO process allows user identity linking
9.1
CVE-2025-22146
Improper authentication on SAML SSO process allows user impersonation in sentry
8.1
CVE-2023-39349
Sentry vulnerable to privilege escalation via ApiTokensEndpoint
7.7
CVE-2026-83803
Sentry: Unsafe pickle deserialization in Relocation Feature