CVE-2026-47716

@@ -441,6 +441,29 @@ def test_issue_details(self):
         response = self.client.get(f"/issues/issue/{self.issue.id}/event/{self.event.id}/details/")
         self.assertContains(response, self.issue.title())
 
+    def test_issue_event_views_do_not_show_events_from_other_projects(self):
+        other_project = Project.objects.create(name="other")
+        other_issue, _ = get_or_create_issue(other_project)
+        other_event = create_event(other_project, other_issue, event_data={
+            "event_id": uuid.uuid4().hex,
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "platform": "python",
+            "exception": {"values": [{"type": "OtherProjectError", "value": "other project stack value"}]},
+            "request": {"headers": {"X-Secret": "other-project-header-value"}},
+            "breadcrumbs": {"values": [{"category": "other-project", "message": "other project breadcrumb"}]},
+        })
+
+        cases = [
+            (f"/issues/issue/{self.issue.id}/event/{other_event.id}/", "other project stack value"),
+            (f"/issues/issue/{self.issue.id}/event/{other_event.id}/details/", "other-project-header-value"),
+            (f"/issues/issue/{self.issue.id}/event/{other_event.id}/breadcrumbs/", "other project breadcrumb"),
+        ]
+        for url, marker in cases:
+            with self.subTest(url=url):
+                response = self.client.get(url)
+                self.assertEqual(response.status_code, 200)
+                self.assertNotContains(response, marker)
+
     def test_issue_tags(self):
         response = self.client.get(f"/issues/issue/{self.issue.id}/tags/")
         self.assertContains(response, self.issue.title())

@@ -422,11 +422,12 @@ def _get_event(qs, issue, event_pk, digest_order, nav, bounds):
     elif event_pk is not None:
         # we match on both internal and external id, trying internal first
         try:
-            return Event.objects.get(pk=event_pk)
+            return Event.objects.get(issue=issue, pk=event_pk)
         except Event.DoesNotExist:
             # we match on external id "for user ergonomics"; notes as in `event_by_id` apply, except for the fact that
-            # in this case we have project availab, guaranteeing uniqueness & fast lookup.
-            return Event.objects.get(project=issue.project, event_id=event_pk)
+            # in this case we have the project available, guaranteeing uniqueness & fast lookup.
+            # We also filter by issue to guarantee we do not escape the URL's issue scope.
+            return Event.objects.get(project=issue.project, issue=issue, event_id=event_pk)
 
     elif digest_order is not None:
         # "ergonomics" when people type this in the URL bar

@@ -420,6 +420,19 @@ def test_issue_list_view(self):
         response = self.client.get(f"/issues/{self.project.id}/")
         self.assertContains(response, self.issue.title())
 
+    def test_issue_list_bulk_action_ignores_issues_from_other_projects(self):
+        other_project = Project.objects.create(name="other")
+        other_issue, _ = get_or_create_issue(other_project)
+
+        response = self.client.post(
+            f"/issues/{self.project.id}/",
+            {"issue_ids[]": [str(other_issue.id)], "action": "resolve"},
+        )
+
+        self.assertEqual(response.status_code, 200)
+        other_issue.refresh_from_db()
+        self.assertFalse(other_issue.is_resolved)
+
     def test_issue_stacktrace(self):
         response = self.client.get(f"/issues/issue/{self.issue.id}/event/{self.event.id}/")
         self.assertContains(response, self.issue.title())

@@ -291,7 +291,7 @@ def issue_list(request, project_pk, state_filter="open"):
 def _issue_list_pt_1(request, project, state_filter="open"):
     if request.method == "POST":
         issue_ids = request.POST.getlist('issue_ids[]')
-        issue_qs = Issue.objects.filter(pk__in=issue_ids)
+        issue_qs = Issue.objects.filter(project=project, is_deleted=False, pk__in=issue_ids)
         illegal_conditions = _q_for_invalid_for_action(request.POST["action"])
         # list() is necessary because we need to evaluate the qs before any actions are actually applied (if we don't,
         # actions are always marked as illegal, because they are applied first, then checked (and applying twice is

@@ -55,6 +55,16 @@ def test_event_plaintext(self):
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response['Content-Type'], 'text/plain')
 
+    def test_event_views_forbid_events_from_other_projects(self):
+        other_project = Project.objects.create(name="other")
+        other_issue, _ = get_or_create_issue(project=other_project)
+        other_event = create_event(other_project, other_issue)
+
+        for suffix in ["download/", "raw/", "plain/", "md/"]:
+            with self.subTest(suffix=suffix):
+                response = self.client.get(f"/events/event/{other_event.pk}/{suffix}")
+                self.assertEqual(response.status_code, 403)
+
 
 class TimeZoneTestCase(DjangoTestCase):
     """This class contains some tests that formalize my understanding of how Django works; they are not strictly tests

@@ -22,7 +22,7 @@
 from bugsink.utils import get_model_topography
 from projects.models import Project, ProjectMembership
 from releases.models import create_release_if_needed
-from events.factories import create_event
+from events.factories import create_event, create_event_data
 from bsmain.management.commands.send_json import Command as SendJsonCommand
 from compat.dsn import get_header_value
 from events.models import Event
@@ -476,6 +476,28 @@ def test_issue_history(self):
         response = self.client.get(f"/issues/issue/{self.issue.id}/history/")
         self.assertContains(response, self.issue.title())
 
+    def test_history_comment_edit_and_delete_scope_to_issue(self):
+        other_issue, _ = get_or_create_issue(self.project, create_event_data(exception_type="OtherIssue"))
+        other_comment = TurningPoint.objects.create(
+            project=self.project,
+            issue=other_issue,
+            kind=TurningPointKind.MANUAL_ANNOTATION,
+            user=self.user,
+            comment="leave me alone",
+            timestamp=datetime.now(timezone.utc),
+        )
+
+        response = self.client.post(
+            f"/issues/issue/{self.issue.id}/history/comment/{other_comment.id}/",
+            {"comment": "changed"},
+        )
+        self.assertEqual(response.status_code, 404)
+
+        response = self.client.post(f"/issues/issue/{self.issue.id}/history/comment/{other_comment.id}/delete/")
+        self.assertEqual(response.status_code, 404)
+        other_comment.refresh_from_db()
+        self.assertEqual(other_comment.comment, "leave me alone")
+
     def test_issue_event_list(self):
         response = self.client.get(f"/issues/issue/{self.issue.id}/events/")
         self.assertContains(response, self.issue.title())

@@ -355,6 +355,7 @@ def event_by_id(request, event_pk):
     # needing that event's issue id when rendering the link, and [b] For external id, it's a useful way to construct
     # links: the external id is all that's known SDK-side and may show up in a log or be stored in a DB.
     # Note that no Auth is needed here because nothing is actually shown.
+    # The redirect may reveal an issue UUID, but does not render event data; issue UUIDs are not treated as secrets.
     try:
         event = Event.objects.get(pk=event_pk)
     except Event.DoesNotExist:

@@ -5,7 +5,7 @@
 
 from bugsink.test_utils import TransactionTestCase25251 as TransactionTestCase
 from bugsink.utils import get_model_topography
-from projects.models import Project, ProjectMembership
+from projects.models import Project, ProjectMembership, ProjectRole
 from events.factories import create_event
 from issues.factories import get_or_create_issue, denormalized_issue_fields
 from tags.models import store_tags
@@ -176,3 +176,39 @@ def test_project_list_skips_open_issue_query_when_over_threshold(self):
 
         issue_filter.assert_not_called()
         self.assertNotContains(response, "open issues")
+
+
+class ProjectScopedActionTestCase(TransactionTestCase):
+
+    def setUp(self):
+        super().setUp()
+        self.user = User.objects.create_user(username="project-admin", password="test")
+        self.project = Project.objects.create(name="owned")
+        ProjectMembership.objects.create(
+            project=self.project, user=self.user, role=ProjectRole.ADMIN, accepted=True)
+        self.client.force_login(self.user)
+
+    def test_member_remove_scopes_to_project(self):
+        other_user = User.objects.create_user(username="other", password="test")
+        other_project = Project.objects.create(name="other")
+        other_membership = ProjectMembership.objects.create(project=other_project, user=other_user)
+
+        response = self.client.post(
+            f"/projects/{self.project.id}/members/",
+            {"action": f"remove:{other_user.id}"},
+        )
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(ProjectMembership.objects.filter(id=other_membership.id).exists())
+
+    def test_alert_service_remove_scopes_to_project(self):
+        other_project = Project.objects.create(name="other")
+        other_service = MessagingServiceConfig.objects.create(project=other_project)
+
+        response = self.client.post(
+            f"/projects/{self.project.id}/alerts/",
+            {"action": f"remove:{other_service.id}"},
+        )
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(MessagingServiceConfig.objects.filter(id=other_service.id).exists())

@@ -1 +1,30 @@
-# Create your tests here.
+from django.contrib.auth import get_user_model
+
+from bugsink.test_utils import TransactionTestCase25251 as TransactionTestCase
+
+from .models import Team, TeamMembership, TeamRole
+
+User = get_user_model()
+
+
+class TeamScopedActionTestCase(TransactionTestCase):
+
+    def setUp(self):
+        super().setUp()
+        self.user = User.objects.create_user(username="team-admin", password="test")
+        self.team = Team.objects.create(name="owned")
+        TeamMembership.objects.create(team=self.team, user=self.user, role=TeamRole.ADMIN, accepted=True)
+        self.client.force_login(self.user)
+
+    def test_member_remove_scopes_to_team(self):
+        other_user = User.objects.create_user(username="other", password="test")
+        other_team = Team.objects.create(name="other")
+        other_membership = TeamMembership.objects.create(team=other_team, user=other_user)
+
+        response = self.client.post(
+            f"/teams/{self.team.id}/members/",
+            {"action": f"remove:{other_user.id}"},
+        )
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(TeamMembership.objects.filter(id=other_membership.id).exists())