Repository navigation
Security: seerr-team/seerr
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Third-party notification credentials of other users exposed via request detail endpointsGHSA-8j73-j6rc-q8xh published
Oct 21, 2026 by M0NsTeRRRModerate -
Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfoGHSA-xc6j-6p6h-p799 published
Oct 21, 2026 by M0NsTeRRRModerate -
Path traversal to RCE via /avatarproxy image cache filename from upstream ETagGHSA-mc6w-69r3-62h8 published
Jul 28, 2026 by M0NsTeRRRHigh -
Missing authentication on pushSubscription endpointsGHSA-gx3h-3jg5-q65f published
Feb 27, 2026 by fallenbagelModerate -
Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification CredentialsGHSA-f7xw-jcqr-57hp published
Feb 27, 2026 by fallenbagelModerate -
Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpointGHSA-rc4w-7m3r-c2f7 published
Feb 27, 2026 by fallenbagelHigh