Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M

CVE-2026-27792Seerr missing authentication on pushSubscription endpoints

Medium 5.4

In plain English

A medium-severity missing authorization in seerr from seerr-team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 84.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
seerr-team	seerr	>= 2.7.0, < 3.1.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f x_refsource_CONFIRM
https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1 x_refsource_MISC
https://github.com/seerr-team/seerr/releases/tag/v3.1.0 x_refsource_MISC