CVE-2026-27792

MEDIUM

5.4

Descripcion

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

Detalles CVE

Puntuacion CVSS v3.15.4

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado2/27/2026

Ultima modificacion3/4/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

seerr:seerr

Debilidades (CWE)

CWE-862

Referencias

https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1(security-advisories@github.com)

https://github.com/seerr-team/seerr/releases/tag/v3.1.0(security-advisories@github.com)

https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.