Security app updates, Part 1: the triage of 38 flagged pins (TRIAGE.md, per-app notes, PICKS.md); R-1306 triaged; R-1310 (watch classifier) and R-1311 (Termix X-Forwarded-For) filed

documentation/audits/security-app-updates-2026-10-27/triage-notes/seerr.md

@@ -0,0 +1,31 @@
+# seerr — triage (pin fallenbagel/jellyseerr:2.7.3)
+Upstream renamed: Jellyseerr/Overseerr → Seerr (seerr-team/seerr). 2.7.3 is the last 2.x (Docker Hub now also has `2.7.3-deprecated`).
+Template: setup_gate: true; no signup_block (Seerr accounts come from the media server's users). Volume /app/config.
+
+## Notices (all 6 REAL by range; /avatarproxy route confirmed present in v2.7.3 source: server/routes/avatarproxy.ts, mounted in server/index.ts)
+| GHSA | sev | login | reachable on a box |
+|---|---|---|---|
+| rc4w-7m3r-c2f7 unauthenticated account registration via /auth/jellyfin | high | none | ONLY if the household configured Plex (Jellyfin-configured installs not affected) |
+| mc6w-69r3-62h8 /avatarproxy ETag path traversal → file write → RCE (AV:A) | high | none to trigger; attacker must control the media server's HTTP response or MITM the plaintext seerr→media-server link | low (media server is the household's own, usually same box/LAN) |
+| f7xw-jcqr-57hp GET /user/:id leaks others' notification creds | medium | any user | household accounts |
+| gx3h-3jg5-q65f pushSubscription routes missing owner check (>=2.7.0) | medium | any user | household accounts |
+| 8j73-j6rc-q8xh request detail endpoints leak others' notification creds | medium | any user | household accounts |
+| xc6j-6p6h-p799 /movie/:id, /tv/:id leak email/plexId | medium | any user | household accounts |
+
+## Fix
+Smallest fixing all: 3.5.0. TARGET image (3.x has a NEW name): `ghcr.io/seerr-team/seerr:v3.5.1` (ghcr tag list verified: v3.0.0..v3.5.1; also
+Docker Hub `seerr/seerr:v3.5.1`). Note the `v` prefix in 3.x (our 2.x pin has none). v3.5.1 adds Node 22.23.4 (eMudhra CA distrust).
+Same main: NO (2 → 3).
+Breaking (10 releases read v3.0.0..v3.5.1): image renamed; container now runs as `node` UID 1000 → /app/config volume must be chowned 1000:1000
+(manual step); automatic Jellyseerr→Seerr settings/DB migration on first start; 3.3.0 webhook field discordID → discordIDs (breaking);
+3.5.0 library API endpoints changed (UI unaffected).
+Lane: BIG_STEP. No fix inside main 2 (quick lane: NO_FIX).
+
+## Options (no fix inside main 2)
+Blocks today: setup_gate until first admin; rc4w only on Plex-configured boxes; others need a household account.
+- Option A: traefik refuses `POST /api/v1/auth/jellyfin` on Plex-configured boxes — cost: per-box config knowledge the template does not have; breaks
+  Jellyfin login if the household later switches. Weak.
+- Option B: BIG_STEP to ghcr.io/seerr-team/seerr:v3.5.1 with a chown step — cost: bench migration test, a volume-ownership step in the update path.
+- If you do nothing: on a Plex-configured box a stranger can create an account and file requests (then read other users' notification tokens).
+Classifier note: watch item names upstream `fallenbagel/jellyseerr`; future fixes only appear under `ghcr.io/seerr-team/seerr` — point the pin's
+registry source there or the watch will never see a newer tag.