Medium severity · published Feb 27, 2026
CVE-2026-27792
Seerr missing authentication on pushSubscription endpoints
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seerr · seerr-team
>= 2.7.0, < 3.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27792
Patch
https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1
Product
https://github.com/seerr-team/seerr/releases/tag/v3.1.0
Vendor Advisory
https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f
More from seerr
9.8
CVE-2026-27707
Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint
7.1
CVE-2026-73291
Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag
6.5
CVE-2026-27793
Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials