CVE-2026-27792: Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the…

PriorityP431medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.21%

11.8th percentile

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
seerr-team	seerr	—	—
seerr	seerr	>= 2.7.0 < 3.1.0	3.1.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.