ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27793

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.

Published Feb 27, 2026 · updated Jun 17, 2026 · seerr seerr

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of their privilege level. This vulnerability can be exploited alone or combined with the reported unauthenticated account creation vulnerability, CVE-2026-27707. When combined, the two vulnerabilities create a zero-prior-access chain that leaks third-party API credentials for all users, including administrators. Version 3.1.0 contains a fix for both this vulnerability and for CVE-2026-27707.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 27, 2026 · NIST NVD

    Detected

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of their privilege level. This vulnerability can be exploited alone or combined with the reported unauthenticated account crea

  2. Jun 17, 2026 · NIST NVD

    Updated

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of their privilege level. This vulnerability can be exploited alone or combined with the reported unauthenticated account crea

Affected

  • cpe seerr/seerrversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27793

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27793

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requ

    nvd.nist.gov

References