Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1 | Patch |
| https://github.com/seerr-team/seerr/releases/tag/v3.1.0 | Product Release Notes |
| https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f | Vendor Advisory |
Configurations
History
04 Mar 2026, 16:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Seerr
Seerr seerr |
|
| CPE | cpe:2.3:a:seerr:seerr:*:*:*:*:*:*:*:* | |
| References | () https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1 - Patch | |
| References | () https://github.com/seerr-team/seerr/releases/tag/v3.1.0 - Product, Release Notes | |
| References | () https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f - Vendor Advisory |
27 Feb 2026, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-27 20:21
Updated : 2026-03-04 16:49
NVD link : CVE-2026-27792
Mitre link : CVE-2026-27792
CVE.ORG link : CVE-2026-27792
JSON object : View
Products Affected
seerr
- seerr
CWE
CWE-862
Missing Authorization