What’s Vulnerable › Vulnerabilities

CVE-2026-27792: Seerr missing authentication on pushSubscription endpoints

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-862

Description

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

Affected products

• seerr-team seerr: from 2.7.0 before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: seerr-team seerr 3.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1
• https://github.com/seerr-team/seerr/releases/tag/v3.1.0
• https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f

Get alerted when CVE-2026-27792 or the next vulnerability affects your stack