Skip to content
Heist/ feed
Back to feed
Medium

Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Type: advisorySources: OSV

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-65696
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 12:27 UTC · Revision 1

Source evidence

Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

core-osv · Original source

Published 23 Jul 2026, 16:24 UTC

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.

osv:CVE-2026-65696
Complete source record
{
  "id": "04754d54b7fe1ef3d4c16b75495b104740dca52139b1f31218bacf9c06b74a8d",
  "url": "https://osv.dev/vulnerability/CVE-2026-65696",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API",
    "summary": "Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.",
    "evidence": "osv:CVE-2026-65696",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-65696",
      "aliases": [
        "CVE-2026-65696"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sct/overseerr",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "8aecb37cd4607a0696725155a5390a5e43816426"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.35.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.35.0",
            "v1.34.0",
            "v1.33.2",
            "v1.33.1",
            "v1.33.0",
            "v1.32.5",
            "v1.32.4",
            "v1.32.3",
            "v1.32.2",
            "v1.32.1",
            "v1.32.0",
            "v1.31.0",
            "v1.30.1",
            "v1.30.0",
            "v1.29.1",
            "v1.29.0",
            "v1.28.0",
            "v1.27.0",
            "v1.26.1",
            "v1.26.0",
            "v1.25.0",
            "v1.24.0",
            "v1.23.2",
            "v1.23.1",
            "v1.23.0",
            "v1.22.0",
            "v1.21.1",
            "v1.21.0",
            "v1.20.1",
            "v1.20.0",
            "v1.19.1",
            "v1.19.0",
            "v1.18.0",
            "v1.17.2",
            "v1.17.1",
            "v1.17.0",
            "v1.16.0",
            "v1.15.0",
            "v1.14.1",
            "v1.14.0",
            "v1.13.0",
            "v1.12.1",
            "v1.12.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.1",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65696.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:28.436186422Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65696.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-65696",
        "https://www.vulncheck.com/advisories/overseerr-authorization-bypass-via-pushsubscriptions-api",
        "https://github.com/sct/overseerr",
        "https://github.com/geo-chen/oss/blob/main/overseerr.md"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65696.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-65696",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 495362,
  "published_at": "2026-07-23T16:24:27.966+00:00"
}