CVE-2026-65696 Details
Description
Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.
A vulnerability in Overseerr versions through 1.35.0 allows for authorization bypass in the push subscription API. This issue enables authenticated users to list, read, and delete any other user's push subscriptions by manipulating the userId in the path parameters. The vulnerability arises from a missing ownership check, which allows access to target user records without applying the usual data filters, thereby exposing sensitive information such as email addresses and Plex IDs.
The vulnerability can be fixed by adding an ownership check to the affected API handlers, ensuring that users can only access their own push subscriptions. Additionally, the response should be modified to filter out sensitive user information before it is sent back to the requester.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/overseerr.md | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/overseerr-authorization-bypass-via-pushsubscriptions-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Overseerr | <= 1.35.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |