Seerr's GET /api/v1/user/:id endpoint returns a full settings object for any authenticated requester, including Pushover, Pushbullet, and Telegram credentials. This lack of object‑level authorization allows an attacker with any authenticated session to retrieve third‑party API keys that belong to other users, potentially enabling them to send messages on behalf of those users or compromise connected services. The flaw is an authorization bypass (CWE‑639). The impact is a confidentiality breach that exposes sensitive credentials. When combined with the unrelated unauthenticated account‑creation flaw (CVE‑2026‑27707), the two become a zero‑privilege chain that can exfiltrate all user credentials, even those of administrators.

The vulnerability affects the open‑source media request manager Seerr, version 3.0.x and earlier. Users running 3.0.x or prior are exposed until they upgrade to the fixed 3.1.0 release. Seerr integrates with media servers such as Jellyfin, Plex, and Emby, but the flaw resides in Seerr itself.

The reported CVSS score is 6.5, indicating moderate severity, and the EPSS score is less than 1 %, meaning the exploitation probability is currently low. The flaw requires only an authenticated session, and attackers do not need elevated privileges to trigger it, so the risk is moderate to high for organizations that allow many users to log in. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild.