CVE-2026-119550: Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

Published Oct 30, 2026

Updated

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Jellyfin instances through 12.4 are exposed where authenticated users with restricted or parental-controlled accounts can access public or shared playlists that include items they are not permitted to view.

What does an attacker need to exploit it?

An attacker needs an authenticated Jellyfin account and access to a public or shared playlist. They can request the playlist endpoint to obtain unfiltered item GUIDs, then use those IDs to stream otherwise inaccessible media.

Are anonymous users affected?

The described attack requires authentication. The available information does not indicate that unauthenticated users can exploit it.

How can I determine whether restricted content may have been exposed?

Review public and shared playlists for entries that include library items hidden from restricted or parental-controlled users. Those users may have been able to retrieve the hidden items' GUIDs through the playlist endpoint and use them to stream the media.

CVE-2026-119550: Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are anonymous users affected?

How can I determine whether restricted content may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are anonymous users affected?

How can I determine whether restricted content may have been exposed?