Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.1 · jellyfinNVD modified 2026-10-30 11:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/SuggestionsController.cs#L70-L95 technical-description
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522 related, vendor-advisory
- https://abraxaslabs.tech/research/jellyfin-suggestions-idor third-party-advisory
- https://github.com/jellyfin/jellyfin product
- https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions third-party-advisory