{"id":"CVE-2026-119551","kind":"vulnerability","aliases":["CVE-2026-119551"],"related":[],"title":"Jellyfin: suggestions endpoint lets users bypass library and parental restrictions","description":"Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.","summary":"Jellyfin through 12.4 has an authorization flaw in its suggestions endpoint: omitting the userId parameter skips library and parental restrictions. An authenticated non-admin user can list restricted items, including server file paths, and stream them.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jellyfin","fixed":[],"affected":"<= 12.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","jellyfin","media-server","package","self-hosted"],"not_affected_if":["no-parental-controls","no-restricted-libraries","single-user"],"how_to_check":"- Check the Jellyfin Server version (Dashboard, or GET /System/Info/Public): 12.4 and earlier are affected, and no fixed release is known yet.\n- With a restricted non-admin account's token, compare GET /Items against GET /Items/Suggestions (no userId). If Suggestions returns items or Path values from libraries that account cannot see, the server is exposed.\n- Search access logs for GET /Items/Suggestions without a userId parameter from non-admin accounts.","fix":null,"status":"open","published_at":"2026-10-30T12:16:41+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:25+00:00","updated_at":"2026-10-30T12:33:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T12:32:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Jellyfin: suggestions endpoint lets users bypass library and parental restrictions","impact":"medium","summary":"Jellyfin through 12.4 has an authorization flaw in its suggestions endpoint: omitting the userId parameter skips library and parental restrictions. An authenticated non-admin user can list restricted items, including server file paths, and stream them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jellyfin","self-hosted","media-server"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"restricted media and server file paths are listed and streamed","analyst_note":"Confirm the fixed version and the exact affected range from the NVD entry or the Jellyfin release notes; the sources given state no fix.","how_to_check":"- Check the installed Jellyfin version against the affected range (through `12.4`).\n- Look for requests to `GET /Items/Suggestions` without a userId parameter in reverse proxy or server access logs.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user","no-parental-controls","no-restricted-libraries"],"who_is_affected":"Jellyfin servers with multiple user accounts where some users have library or parental restrictions. A server with a single user, or where every account is an administrator, has no restriction to bypass. Servers where users cannot log in are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4163,"output_tokens":529,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact affected range from the NVD entry or the Jellyfin release notes; the sources given state no fix.","search":"'-119551':13A,16A '-2026':12A,15A '/items/suggestions':96C '12.4':29B,65C 'admin':51B 'administr':78C 'allow':74C 'attack':91C 'authent':18B,48B,75C 'author':32B,68C 'bypass':6A,69C,81C 'call':94C 'contain':66C 'cve':11A,14A 'endpoint':3A,37B 'enumer':100C 'file':59B 'filesystem':107C 'flaw':33B 'get':95C 'host':26B 'id':104C 'includ':57B,103C 'item':56B,102C 'jellyfin':1A,17A,19B,27B,63C 'let':4A 'librari':7A,43B,82C 'list':54B 'media':21B 'media-serv':20B 'non':50B,77C 'non-admin':49B 'non-administr':76C 'omit':38B,87C 'packag':23B 'paramet':41B,90C 'parent':9A,45B,84C 'path':60B,108C 'repeat':93C 'restrict':10A,46B,55B,85C,101C 'self':25B 'self-host':24B 'server':22B,58B,106C 'skip':42B 'stream':62B,111C 'suggest':2A,36B 'suggestionscontroller.getsuggestions':72C 'user':5A,52B,79C 'userid':40B,89C,98C 'vulner':70C 'without':97C","nicknames":[],"mitigations":[],"who_affected":"Jellyfin servers with multiple user accounts where some users have library or parental restrictions. A server with a single user, or where every account is an administrator, has no restriction to bypass. Servers where users cannot log in are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119551","severity":null,"published_at":"2026-10-30T12:16:41+00:00","modified_at":"2026-10-30T12:16:41+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119551:1155","url":null,"severity":null,"published_at":"2026-10-30T12:33:40+00:00","modified_at":"2026-10-30T12:33:40+00:00","first_seen_at":"2026-10-30T12:33:40+00:00","fetched_at":"2026-10-30T12:33:40+00:00","note":"VulnCheck (CNA) says Jellyfin <= 12.4 affected; researcher Abraxas Labs reproduced on 12.2 (disclosed 17 Oct, null-user branch in SuggestionsController.GetSuggestions skips GetUserId). Jellyfin's releases page (12.4, 26 Oct, latest) lists no fix; no Jellyfin advisory for this CVE found (GHSA-9x85 linked by VulnCheck is a different playlist bug, fixed 12.0). Fix unknown; nothing verified. Settle by checking for a 12.5 release or a Jellyfin GHSA."}],"documents":[{"id":23438,"url":"https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions","title":"VulnCheck: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23440,"url":"https://abraxaslabs.tech/research/jellyfin-suggestions-idor","title":"Abraxas Labs: Jellyfin 12.2 Suggestions omit-userId hidden-library dump","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":23442,"url":"https://github.com/jellyfin/jellyfin/releases","title":"Jellyfin Server releases (12.0 to 12.4)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}