Executive brief
Overseerr, a request management tool for media libraries, contains a security flaw in its notification system. An authenticated user can view or delete the notification settings of any other user on the system by manipulating web requests. This could lead to the exposure of sensitive account information, such as email addresses and media service identifiers, or the disruption of notification services for other users.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639, exists in the push subscription API of Overseerr through version 1.35.0. The vulnerability is caused by a missing ownership check in the API handlers, which allows an authenticated attacker to supply an arbitrary 'userId' in the path parameters. By doing so, the attacker can bypass the 'filteredFields' filter to access sensitive user records, including email addresses and plexId values, or delete push subscriptions belonging to other users. The project was archived in February 2026, and no official patch has been announced.
Affected products
- sct Overseerr through 1.35.0
Timeline
- 2026-02-16: other: Project archived by maintainers
- 2026-07-23: advisory: Vulnerability disclosed by VulnCheck