PT-2026-22383 · Telegram+6 · Telegram+6

Mandreko · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-27793

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Seerr versions prior to 3.1.0

Description Seerr is a media request and discovery manager for Jellyfin, Plex, and Emby. The GET /api/v1/user/:id API endpoint improperly discloses the full settings object for any user, including credentials for Pushover, Pushbullet, and Telegram, to any authenticated requester, irrespective of their privilege level. This issue can be exploited independently or in conjunction with an unauthenticated account creation issue. Exploiting both issues creates a zero-prior-access chain that leaks third-party API credentials for all users, including administrators. The variable id in the API endpoint is vulnerable.

Recommendations Update to version 3.1.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-27793

GHSA-F7XW-JCQR-57HP

Affected Products

Emby

Jellyfin

Plex

Pushbullet

Pushover

Seerr

Telegram

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27793.json · Exploit
• https://github.com/seerr-team/seerr/commit/4f089b29d0bb41d382168b17aa152eb5b8a25303 · Patch
• https://github.com/seerr-team/seerr/security/advisories/GHSA-f7xw-jcqr-57hp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27793 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27793 · Vendor Advisory
• https://github.com/seerr-team/seerr/releases/tag/v3.1.0 · Note
• https://t.me/cveNotify/154145 · Telegram Post
• https://twitter.com/CVEnew/status/2027744254118838717 · Twitter Post