Seerr 3.5.0 changes Plex and Jellyfin library API endpoints and patches two security leaks

Seerr, the request manager formerly known as Jellyseerr, shipped version 3.5.0 on 2026-09-28 (release notes). The headline item is a breaking API change, but the two security patches are the part most admins should act on first.

What changed

• Library endpoints no longer have side effects. GET /settings/plex/library and GET /settings/jellyfin/library no longer accept the sync or enable query parameters, and simply reading the library list no longer flips a library's enabled state.
• New dedicated routes replace the old behavior. Syncing now goes through POST /settings/plex/library/sync and POST /settings/jellyfin/library/sync. Enabling or disabling a single library uses PUT /settings/plex/library/{libraryId} and PUT /settings/jellyfin/library/{libraryId}.
• The web UI already uses the new endpoints, so only scripts, integrations and third-party clients that call the API directly are affected. Because the blast radius is limited, the team shipped this in a minor release instead of a major one.

Security fixes

Two advisories are patched in this release: GHSA-8j73-j6rc-q8xh, where third-party notification credentials belonging to other users could leak through request detail endpoints, and GHSA-xc6j-6p6h-p799, where unfiltered user objects (email, plexId, permissions) and issue contents could leak through mediaInfo on /movie/:id and /tv/:id.

Other additions

Outbound requests now carry a Seerr user agent, notifications gain ntfy.sh tag support and an embed poster option for Gotify, override rules now apply to advanced requests, and the settings include an option to hide already requested media. There is also a user search box for lookup by username or email, a demo feature, and support for a custom Plex metadata provider GUID scheme in the scanner. The bug fix list covers Quick Connect avatar refresh, PostgreSQL timestamp import, leftover Overseerr DELETED status after migration, Jellyfin authorization headers, hiding the Quick Connect button for Emby servers, and more.

Commentary for self-hosters

If you only use the Seerr web interface, upgrading is a low-risk affair — but do it soon, because the two patched leaks expose other users' notification credentials and account details to anyone who can reach those endpoints. The API change is the one to plan for: audit cron jobs, Discord bots, dashboards and any homegrown glue that hits the library endpoints with sync or enable, and move them to the new POST and PUT routes before you upgrade. Reading a library list should never quietly rewrite your configuration, so the new split is the right design. If your stack also includes Plex, our Plex products may be worth a look alongside the upgrade.