CVE-2026-26004

CVE-2026-26004 is a cross-organization Insecure Direct Object Reference (IDOR) vulnerability affecting Sentry versions prior to 26.1.0, specifically within its GroupEventJsonView endpoint. This flaw allows an authenticated attacker with low privileges to gain unauthorized access to sensitive event data belonging to other organizations. Rated as Medium severity with a CVSS score of 6.5, the vulnerability has a network attack vector and low attack complexity, leading to a high impact on confidentiality due to data disclosure. There is currently no evidence of active exploitation, nor are public exploit modules available on platforms like Metasploit or ExploitDB. Community attention is minimal, with only one reported media article from GitHub Security Lab detailing the issue.