EUVD-2026-48309
GHSA-wmhm-gprw-r443
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requiring only a low-privilege session; limited C and I impact confined to push subscription data and associated PII.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.
AnalysisAI
Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Technical ContextAI
Overseerr (CPE: cpe:2.3:a:sct:overseerr:*:*:*:*:*:*:*:*) is a self-hosted media request management application built for Plex environments. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), the canonical Insecure Direct Object Reference (IDOR) pattern: the API handler for push subscriptions accepts a userId path parameter and acts on the corresponding record without verifying whether the authenticated caller owns or is authorized to access that record. The filteredFields mechanism, which normally constrains what data is returned to non-admin users, is also bypassed in these handlers, meaning the caller receives the full user object including fields that would ordinarily be redacted. Affected API operations include listing, reading, and deleting push subscriptions.
RemediationAI
No confirmed vendor-patched release version was identified in the available data - users should monitor the official Overseerr GitHub repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/overseerr-authorization-bypass-via-pushsubscriptions-api for patch availability and upgrade immediately upon release. As a compensating control, administrators should restrict Overseerr access to trusted networks or authenticated VPN tunnels, reducing the exposure surface to users who already have system-level trust. Disabling push notification subscriptions entirely (if the feature is non-critical) removes the vulnerable endpoint from the attack surface with no functional impact on core media request workflows. Audit existing push subscription records for unexpected access or deletions using application logs, as the integrity impact allows subscription deletion that may not be immediately visible to victims.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today