---
id: "CVE-2026-119551"
kind: "vulnerability"
aliases: ["CVE-2026-119551"]
title: "Jellyfin: suggestions endpoint lets users bypass library and parental restrictions"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "jellyfin", "fixed": [], "affected": "<= 12.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "jellyfin", "media-server", "package", "self-hosted"]
not_affected_if: ["no-parental-controls", "no-restricted-libraries", "single-user"]
published_at: "2026-10-30T12:16:41+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:33:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119551", "first_seen_at": "2026-10-30T12:30:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T12:33:40+00:00"}]
---

# Jellyfin: suggestions endpoint lets users bypass library and parental restrictions

Jellyfin through 12.4 has an authorization flaw in its suggestions endpoint: omitting the userId parameter skips library and parental restrictions. An authenticated non-admin user can list restricted items, including server file paths, and stream them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:jellyfin affected <= 12.4 fixed ?

## How to check

- Check the Jellyfin Server version (Dashboard, or GET /System/Info/Public): 12.4 and earlier are affected, and no fixed release is known yet.
- With a restricted non-admin account's token, compare GET /Items against GET /Items/Suggestions (no userId). If Suggestions returns items or Path values from libraries that account cannot see, the server is exposed.
- Search access logs for GET /Items/Suggestions without a userId parameter from non-admin accounts.

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119551
- 2026-10-30T12:33:40+00:00 analyst — VulnCheck (CNA) says Jellyfin <= 12.4 affected; researcher Abraxas Labs reproduced on 12.2 (disclosed 17 Oct, null-user branch in SuggestionsController.GetSuggestions skips GetUserId). Jellyfin's releases page (12.4, 26 Oct, latest) lists no fix; no Jellyfin advisory for this CVE found (GHSA-9x85 linked by VulnCheck is a different playlist bug, fixed 12.0). Fix unknown; nothing verified. Settle by checking for a 12.5 release or a Jellyfin GHSA.

## Documents

- [advisory] VulnCheck: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions
- [describes] Abraxas Labs: Jellyfin 12.2 Suggestions omit-userId hidden-library dump https://abraxaslabs.tech/research/jellyfin-suggestions-idor
- [mentions] Jellyfin Server releases (12.0 to 12.4) https://github.com/jellyfin/jellyfin/releases

## From the sources

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_