NVD security advisory
Security advisory for Jellyfin
CVE-2026-119551
Full advisory details, affected packages, severity context, and original source.
Affected technology
JellyfinAffected product
Advisory overview
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Related references
- https://abraxaslabs.tech/research/jellyfin-suggestions-idor
- https://github.com/jellyfin/jellyfin
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/SuggestionsController.cs#L70-L95
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522
- https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions