S
eerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1 | Patch |
| https://github.com/seerr-team/seerr/releases/tag/v3.1.0 | Product Release Notes |
| https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f | Vendor Advisory |
Configurations
History
04 Mar 2026, 16:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1 - Patch | |
| References | () https://github.com/seerr-team/seerr/releases/tag/v3.1.0 - Product, Release Notes | |
| References | () https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f - Vendor Advisory | |
| CPE | cpe:2.3:a:seerr:seerr:*:*:*:*:*:*:*:* | |
| First Time |
Seerr seerr
Seerr |
27 Feb 2026, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-27 20:21
Updated : 2026-03-04 16:49
NVD link : CVE-2026-27792
Mitre link : CVE-2026-27792
CVE.ORG link : CVE-2026-27792
JSON object : View
CWE
CWE-862
Missing Authorization