CVE-2026-83803 | CyberRota

CyberRota Analysis

AI-Generated

Sentry instances with the relocation feature enabled, specifically versions 23.11.0 to 26.7.0, are vulnerable to arbitrary code execution due to unsafe deserialization of a legacy database field during the import of user-supplied relocation archives. This vulnerability primarily affects self-hosted installations that have enabled the relocation feature, allowing authenticated users to exploit the flaw. Organizations using Sentry in a self-hosted environment should prioritize upgrading to version 26.7.0 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals

arbitrary code execution code execution

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-83803

Severity

HIGH

CVSS

7.7

EPSS

0.60%

Original NVD Description

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process. Self-hosted installations using the default configuration are not affected because the relocation feature is disabled by default. This issue is fixed in version 26.7.0.