CVE-2026-65696
Deferred Deferred - Pending Action

Authorization Bypass in Overseerr Push Subscription API

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65696
EUVD
EUVD-2026-48309

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
overserr overserr 1.35.0
overseerr overseerr to 1.35.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65696 is an authorization bypass vulnerability in Overseerr through version 1.35.0. It allows authenticated users to manipulate API path parameters to access, read, or delete other users' push subscriptions by changing the userId in the request. The application fails to verify ownership of the data being accessed, exposing sensitive information like email addresses and Plex IDs.

Detection Guidance

To detect this vulnerability, monitor API requests to /api/v1/user/{userId}/pushSubscriptions endpoints. Check for unauthorized access attempts where userId is manipulated to access other users' data. Review logs for suspicious activity involving push subscription modifications or data leaks.

Impact Analysis

If you use Overseerr, an attacker with an account could access your push notifications, delete them, or view your email and Plex ID. This could disrupt your notifications, delay approvals, or leak your private information. Even administrators' data may be exposed if the attacker targets them.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Exposure of email addresses and Plex IDs may constitute a data breach, requiring notifications to affected users and authorities under these regulations.

Mitigation Strategies

Immediately update Overseerr to the latest patched version. Implement strict ownership verification for all API endpoints handling user data. Ensure sensitive fields like email and plexId are filtered out in responses. Restrict API access to authenticated users only and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart