PT-2026-22383 · Telegram+6 · Telegram+6

Mandreko · Publicado 2026-02-27 · Atualizado 2026-03-04 · CVE-2026-27793

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Seerr versions prior to 3.1.0

Description Seerr is a media request and discovery manager for Jellyfin, Plex, and Emby. The GET /api/v1/user/:id API endpoint improperly discloses the full settings object for any user, including credentials for Pushover, Pushbullet, and Telegram, to any authenticated requester, irrespective of their privilege level. This issue can be exploited independently or in conjunction with an unauthenticated account creation issue. Exploiting both issues creates a zero-prior-access chain that leaks third-party API credentials for all users, including administrators. The variable id in the API endpoint is vulnerable.

Recommendations Update to version 3.1.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-27793

GHSA-F7XW-JCQR-57HP

Produtos afetados

Emby

Jellyfin

Plex

Pushbullet

Pushover

Seerr

Telegram

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27793.json · Exploit
• https://github.com/seerr-team/seerr/commit/4f089b29d0bb41d382168b17aa152eb5b8a25303 · Correção
• https://github.com/seerr-team/seerr/releases/tag/v3.1.0 · Nota
• https://github.com/seerr-team/seerr/security/advisories/GHSA-f7xw-jcqr-57hp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27793 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27793 · Aviso do Fabricante
• https://t.me/cveNotify/154145 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2027744254118838717 · Publicação no Twitter