Overseerr
Monthly
Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.