{"metadata": {"vulnerability": "CVE-2026-61826", "count": 17, "kinds": {"milestone": 3, "sighting": 8, "kev": 0, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-10T20:17:57.993Z", "date_only": false, "value": "2026-07-10T20:17:57.993Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-29T08:01:20.519Z", "date_only": false, "value": "2026-07-29T08:01:20.519498Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/nxblog/1758", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "7d57cd9d-a237-45ee-a5cf-58f8986855d5", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "url": "https://t.me/nxblog/1758"}, {"timestamp": "2026-08-01T20:00:05.927Z", "date_only": false, "value": "2026-08-01T20:00:05.927522Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/nxblog/1758", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "45f298c2-aa82-4e24-8b6a-e47eed1f746a", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "url": "https://t.me/nxblog/1758", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61826", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:17:27.497Z", "date_only": false, "value": "2026-10-30T17:17:27.497", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61826", "record": "FKIE_CVE-2026-61826", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T17:18:34.926Z", "date_only": false, "value": "2026-10-30T17:18:34.926484Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117530998502093970", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "914c2a73-1c81-44df-bd23-1ddb77b9bea2", "content": "CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61826https://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4https://github.com/morpheus65535/bazarr/commit/4bd29252feebd0803e84cc3ce1bdd24c3a076ed4https://github.com/morpheus65535/bazarr/commit/f9a8a9514944be0e7b826e67cde042cebfe9c97ehttps://github.com/morpheus65535/bazarr/tree/v1.5.7-beta.14#morpheus65535 #bazarr#CVE_2026_61826#bot", "url": "https://infosec.exchange/users/cve/statuses/117530998502093970"}, {"timestamp": "2026-10-30T17:30:56.923Z", "date_only": false, "value": "2026-10-30T17:30:56.923884Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz4coebglv27", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "43800042-e125-4f84-8b66-c345e8fe5336", "content": "\ud83d\udd34 CVE-2026-61826 - Critical (10)\n\nBazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex`...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61826/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz4coebglv27"}, {"timestamp": "2026-10-30T17:31:54.923Z", "date_only": false, "value": "2026-10-30T17:31:54.923674Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mz4cq2ierrtf", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "6d969c15-e6d0-4758-87eb-3450e9c1c39e", "content": "CVE Radar | CVE-2026-61826 | CVSS 10.0\n\nBazarr Anonymous Plex API Mutation Vulnerability\n\nThe NVD record describes a critical Bazarr vulnerability affecting versions before 1.5.7-beta.14.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1345", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mz4cq2ierrtf"}, {"timestamp": "2026-10-30T18:08:29.908Z", "date_only": false, "value": "2026-10-30T18:08:29.908075Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz4erizq7j2t", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "a4a7b6bc-eac3-42c5-98ab-e56f08f7a9b9", "content": "\ud83d\udea8 CVE-2026-61826 \u2014 CVSS 10 CRITICAL\n\nBazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61826\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz4erizq7j2t"}, {"timestamp": "2026-10-30T19:32:32.457Z", "date_only": false, "value": "2026-10-30T19:32:32.457374Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/bqoro2wy7543t", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "a9d08eef-5f67-438e-87d9-80e1214dd1dc", "content": "\ud83d\udea8 CVE-2026-61826\nAffected product: see description\nCVSS 10.0 / KEV: No\nTL;DR: Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` o\u2026\nhttps://cvesentinel.com/report/CVE-2026-61826\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/bqoro2wy7543t"}, {"timestamp": "2026-10-30T21:00:06.039Z", "date_only": false, "value": "2026-10-30T21:00:06.039037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4oedz2py2p", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "198d1bd6-7590-4da6-b87c-7712c29dbf14", "content": "CVE-2026-61826 - bazarr\nIn versions of Bazarr before 1.5.7-beta.14, the Plex integration endpoints do not require any login, so anyone on the network can change settings, add their own Plex credentials,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bazarr #morpheus65535 #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4oedz2py2p"}, {"timestamp": "2026-11-05T02:24:51.591Z", "date_only": false, "value": "2026-11-05T02:24:51.591160Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61826", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-05T02:24:51.591Z", "date_only": false, "value": "2026-11-05T02:24:51.591160Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61826", "record": "FKIE_CVE-2026-61826", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-05T02:25:08.949Z", "date_only": false, "value": "2026-11-05T02:25:08.949Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T02:25:08.949Z", "date_only": false, "value": "2026-11-05T02:25:08.949Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61826", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T03:17:29.197Z", "date_only": false, "value": "2026-11-05T03:17:29.197", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61826", "record": "FKIE_CVE-2026-61826", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T01:23:41.886Z", "anchors": {"origin": {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-01T20:00:05.927Z", "date_only": false, "value": "2026-08-01T20:00:05.927522Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/nxblog/1758", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "45f298c2-aa82-4e24-8b6a-e47eed1f746a", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "url": "https://t.me/nxblog/1758", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -7765957.457, "hours": -2157.2104047222224, "days": -89.88376686342593, "min_seconds": -7765957.457, "max_seconds": -7765957.457, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-01T20:00:05.927Z", "date_only": false, "value": "2026-08-01T20:00:05.927522Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/nxblog/1758", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "45f298c2-aa82-4e24-8b6a-e47eed1f746a", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "url": "https://t.me/nxblog/1758", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1239058.502651, "hours": 344.1829174030555, "days": 14.34095489179398, "min_seconds": 1239058.502651, "max_seconds": 1239058.502651, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T17:12:43.384Z", "date_only": false, "value": "2026-10-30T17:12:43.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61826", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T01:23:41.886Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 9005015.959651, "hours": 2501.393322125278, "days": 104.22472175521992, "min_seconds": 9005015.959651, "max_seconds": 9005015.959651, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-01T20:00:05.927Z", "date_only": false, "value": "2026-08-01T20:00:05.927522Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/nxblog/1758", "record": "CVE-2026-61826", "field": "creation_timestamp", "uuid": "45f298c2-aa82-4e24-8b6a-e47eed1f746a", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "url": "https://t.me/nxblog/1758", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T01:23:41.886Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}