Live › vulnerability › CVE-2026-119551
Jellyfin through 12.4 has an authorization flaw in its suggestions endpoint: omitting the userId parameter skips library and parental restrictions. An authenticated non-admin user can list restricted items, including server file paths, and stream them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Jellyfin servers with multiple user accounts where some users have library or parental restrictions. A server with a single user, or where every account is an administrator, has no restriction to bypass. Servers where users cannot log in are not exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| jellyfin | vendor | <= 12.4 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
This page as .md · .json · in your agent: get_signal("CVE-2026-119551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.