What is the CVSS score of CVE-2026-27792?

CVE-2026-27792 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Seerr are affected by CVE-2026-27792?

Organizations using the application starting in should be aware of moderate risk from CVE-2026-27792, a missing authorization vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2026-27792?

Within 30 days: Identify affected systems running the application starting in and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Seerr CVE-2026-27792

MEDIUM

Missing Authorization (CWE-862)

2026-02-27 security-advisories@github.com

Authentication Bypass Seerr

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 04, 2026 - 16:49 nvd

Patch available

CVE Published

Feb 27, 2026 - 20:21 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the isOwnProfileOrAdmin() middleware on several push subscription API routes. Version 3.1.0 fixes the issue.

AnalysisAI

Seerr versions 2.7.0 through 3.0.x contain an authorization bypass in push subscription API endpoints that allows authenticated users to read and modify other users' data due to missing permission checks. An attacker with valid credentials can exploit this to access sensitive information and alter configurations belonging to arbitrary accounts. The vulnerability is fixed in version 3.1.0.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Seerr. Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the isOwnProfileOrAdmin() middleware on several push subscription API routes. Version 3.1.0 fixes the issue.