Live › vulnerability › CVE-2026-119550
Jellyfin through 12.4 returns unfiltered item IDs in public or shared playlists, so authenticated users can learn IDs of library items they are not allowed to see. A restricted or parental-controlled user can then stream that hidden media using those IDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Servers running Jellyfin through 12.4 with multiple user accounts, especially where some users have library restrictions or parental controls. A single-user server with no restricted accounts has no one to exploit this. The sources do not say which fixed version resolves it.
No product ranges from the sources yet.
jellyfin --version or the dashboard's About page) and compare it against the affected range through 12.4.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.
This page as .md · .json · in your agent: get_signal("CVE-2026-119550")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.