GHSA-9x85-gx46-6522: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Published Oct 30, 2026

Updated

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.

Other sources

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

— OSV

Event History

Oct 30, 2026

CVE Published

via OSV·11:31 AM

Data Sourced

via OSV·11:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit these issues?

An authenticated non-administrator Jellyfin user can exploit the Suggestions endpoint issue. Any authenticated user who can request a public or shared playlist may obtain hidden item IDs through the playlist issue.

What access does an attacker need?

The attacker needs valid Jellyfin authentication and does not need administrator privileges or user interaction. For the Suggestions issue, they omit the userId parameter from GET /Items/Suggestions; for the playlist issue, they request public or shared playlists.

What information or content can be exposed?

The Suggestions issue can expose restricted item identifiers and server filesystem paths, and may allow the attacker to stream restricted media. The playlist issue exposes GUIDs of inaccessible library items from unfiltered playlist ItemIds, which can then be used to stream hidden media.

Are parental and library restrictions affected?

Yes. The affected behavior allows restricted or parental-controlled users to bypass library and parental restrictions and access items that should be inaccessible to them.

GHSA-9x85-gx46-6522: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Other sources

Event History

Frequently Asked Questions

Who can exploit these issues?

What access does an attacker need?

What information or content can be exposed?

Are parental and library restrictions affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit these issues?

What access does an attacker need?

What information or content can be exposed?

Are parental and library restrictions affected?