CVE-2026-65696

Name of the Vulnerable Software and Affected Versions Overseerr versions prior to 1.35.1

Description An authorization bypass exists in the push subscription API. Authenticated users can list, read, and delete push subscriptions belonging to other users by providing an arbitrary userId in the path parameters. This occurs because the affected handlers lack an ownership check, allowing access to user records without the filteredFields filter. This can lead to the leak of sensitive data, such as email addresses and plexId values.

Recommendations Update to a version newer than 1.35.0.