CVE-2026-65696
Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.
| CWE | CWE-639 |
| Vendor | sct |
| Product | overseerr |
| Published | Jul 23, 2026 |
| Last Updated | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for sct overseerr
Be the first to know when new medium vulnerabilities affecting sct overseerr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
sct / overseerr
0 ≤ 1.35.0
References
Credits
George Chen