CVE-2026-30975

Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: `Disabled for Local Addresses`) without a reverse proxy running in front of Sonarr that didn't not pass through the invalid header. Patches are available in version 4.0.16.2942 in the nightly/develop branch and version 4.0.16.2944 for stable/main releases. Some workarounds are available. Make sure Sonarr's Authentication Required setting is set to `Enabled`, run Sonarr behind a reverse proxy, and/or do not expose Sonarr directly to the internet and instead rely on accessing it through a VPN, Tailscale or a similar solution.

• CWE-290

• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942Release Notes
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944Release Notes
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9rVendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30968Coral Server is open collaboration infrastructure that enabl…9.8
• CVE-2026-30969Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30970Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30972Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30973Appium is an automation framework that provides WebDriver-ba…6.5
• CVE-2026-30974Copyparty is a portable file server. Prior to v1.20.11., the…5.4
• CVE-2026-30976Sonarr is a PVR for Usenet and BitTorrent users. In versions…7.5
• CVE-2026-30977RenderBlocking is a MediaWiki extension that allows interfac…2
• CVE-2026-30978iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-30979iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-3098The Smart Slider 3 plugin for WordPress is vulnerable to Arb…6.5
• CVE-2026-30980iccDEV provides a set of libraries and tools for working wit…5.5