---
id: "CVE-2026-119550"
kind: "vulnerability"
aliases: ["CVE-2026-119550"]
title: "Jellyfin: playlist requests reveal hidden media IDs to restricted users"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["jellyfin", "media-server", "runtime", "self-hosted"]
not_affected_if: ["no-public-playlists", "no-restricted-users", "single-user-server"]
published_at: "2026-10-30T12:16:41+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:34:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119550", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# Jellyfin: playlist requests reveal hidden media IDs to restricted users

Jellyfin through 12.4 returns unfiltered item IDs in public or shared playlists, so authenticated users can learn IDs of library items they are not allowed to see. A restricted or parental-controlled user can then stream that hidden media using those IDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jellyfin server version (`jellyfin --version` or the dashboard's About page) and compare it against the affected range through 12.4.
- Look for user accounts with restricted access or parental controls that can also reach public or shared playlists.

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119550

## From the sources

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_