CVE-2026-65696 describes an authorization bypass vulnerability in Overseerr through version 1.35.0. The issue exists in the push subscription API where authenticated users can manipulate the userId path parameter to access or delete push subscriptions belonging to other users. The root cause is the absence of ownership verification in the affected API handlers, which leads to unauthorized access to sensitive user information including email addresses and plexId values. This vulnerability is classified with a medium severity and a CVSS 4.0 base score of 5.3. There is no vendor advisory or patch available at this time, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Exploitation of this vulnerability allows authenticated users to bypass authorization controls and access or delete push subscription data of other users. This results in unauthorized disclosure of sensitive personal information such as email addresses and plexId identifiers. The impact is limited to authenticated users and does not require user interaction. The vulnerability does not escalate privileges beyond the authenticated user context but compromises user privacy and data integrity within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the push subscription API to trusted users only and monitor for suspicious activity involving userId parameters. Consider implementing custom access controls or temporary workarounds to enforce ownership verification on push subscription operations.