The flaw in Overseerr up to version 1.35.0 is an authorization bypass that occurs when an authenticated user submits an arbitrary user identifier to the pushSubscriptions API. The endpoint lacks an ownership check, enabling read, and delete any other user’s push subscription data. The exposed data include email addresses and Plex identifiers, constituting a privacy and confidentiality breach. The weakness is classified as CWE‑639 (Improper Authorization).

Overseerr applications running version 1.35.0 or earlier are vulnerable. No additional affected versions are listed, so users should assume all prior releases share this flaw until a fixed version is released.

The vulnerability carries a CVSS score of 5.3 indicating moderate severity, while the EPSS score of less than 1 % reflects a low yet non‑zero probability of exploitation at the time of assessment. It is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and knowledge of the target user’s identifier; the missing ownership check in the endpoint’s handlers is the primary attack vector. Adversaries can obtain the target user’s subscription records and sensitive fields such as email and plex ID, which could be leveraged for targeted phishing or service disruption.