CVE-2026-27793

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27793
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27793.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27793
Aliases
  • GHSA-f7xw-jcqr-57hp
Published
2026-02-27T19:38:49.589Z
Modified
2026-03-03T02:56:44.190667Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials
Details

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the GET /api/v1/user/:id endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of their privilege level. This vulnerability can be exploited alone or combined with the reported unauthenticated account creation vulnerability, CVE-2026-27707. When combined, the two vulnerabilities create a zero-prior-access chain that leaks third-party API credentials for all users, including administrators. Version 3.1.0 contains a fix for both this vulnerability and for CVE-2026-27707.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27793.json"
}
References

Affected packages

Git / github.com/seerr-team/seerr

Affected ranges

Type
GIT
Repo
https://github.com/seerr-team/seerr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
94a70bb5fc9a4486857071a6fc048c8081fa7ca9

Affected versions

Other
preview-post-blacklist
preview-post-fetch
preview-pr182
preview-pr338
preview-pr374
preview-pr524
preview-pre-blacklist
preview-pre-fetch
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v3.*
v3.0.0
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27793.json"