CVE-2022-23485 - CVE House
Back to Database
Status published Medium CVE-2022-23485

Invite code reuse via cookie manipulation in sentry

Vulnerability Description

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23485

Credits & Attribution

No credits recorded in the NVD database.

References

More from getsentry

View All →
CVE-2025-65944
Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`
Medium 5.1
CVE-2025-53099
Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation
Medium 5.5
CVE-2025-22146
Improper authentication on SAML SSO process allows user impersonation in sentry
Critical 9.1
CVE-2024-53253
Sentry's improper error handling leaks Application Integration Client Secret
Medium 5.3
CVE-2024-45606
Improper authorization on muting of alert rules in sentry
High 7.1

Affected Vendor

Affected Software

sentry
Vulnerable Versions:
>= 20.6.0, < 22.11.0

Timeline

Official Publish: December 10th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-269 CWE-284

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact