getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0 Webpack Integration improper authorization

Summaryinfo

A vulnerability was found in getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0. It has been rated as critical. The affected element is an unknown function of the component Webpack Integration. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-114139. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in getsentry sentry-javascript up to 9.47.1/10.75.1/11.0.0-rc.0. This issue affects an unknown function of the component Webpack Integration. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path with valid o and p query parameters. When an application route directly collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control. This issue is fixed in versions 9.47.2, 10.75.2, and 11.0.0-rc.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-114139 since 10/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 9.47.2, 10.75.2 or 11.0.0-rc.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• getsentry

Name

• sentry-javascript

Version

• 9.47.0
• 9.47.1
• 10.75.0
• 10.75.1
• 11.0.0-rc

Website

• Product: https://github.com/getsentry/sentry-javascript/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion