VulnerabilityAnalyzed

CVE-2026-27792

A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0.

MEDIUM 5.4EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: seerr/seerr
Source: security-advisories@github.com

References

https://github.com/seerr-team/seerr/commit/946bdecec524b4e7f8aaf8f2b3856f319a3580c1Patch
https://github.com/seerr-team/seerr/releases/tag/v3.1.0Product, Release Notes
https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65fVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.