CVE-2026-119551 in Jellyfin
Summary
by MITRE • 10/30/2026
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Jellyfin versions through 12.4 represents a critical authorization bypass within the SuggestionsController.GetSuggestions endpoint. This flaw stems from an insufficient validation of access control parameters during the processing of user requests for media suggestions. Specifically, the application fails to enforce mandatory association between the requesting entity and their authorized library permissions when the userId parameter is omitted from the request payload or query string. In a properly secured system, every API call that retrieves sensitive data must explicitly verify that the authenticated session possesses the requisite privileges to access the specific resources being requested. However, in this implementation, the absence of an explicit user identifier causes the backend logic to default to a broader scope of visibility, effectively treating the request as if it were made by a user with unrestricted access or failing to apply the necessary filtering rules that restrict content based on library ownership and parental control settings.
From a technical perspective, this issue classifies under CWE-285 Improper Authorization, where the application does not properly enforce restrictions on what an authenticated user is allowed to do. The vulnerability allows non-administrator users who have valid credentials but limited permissions to circumvent these limitations by manipulating the input parameters of the API call. By intentionally omitting the userId parameter in GET requests directed at /Items/Suggestions, attackers can trigger a code path that bypasses the standard permission checks. This behavior indicates a flaw in how the framework resolves user context when explicit identifiers are missing, leading to an elevation of privileges relative to the intended security policy. The lack of strict input validation and default deny logic for ambiguous contexts creates a predictable attack vector that does not require complex exploitation techniques or privilege escalation beyond what is already granted by basic authentication.
The operational impact of this vulnerability is significant as it enables unauthorized enumeration and access to restricted media content. Attackers can systematically call the affected endpoint without providing user identification, thereby retrieving metadata such as item IDs and server filesystem paths for items that should be hidden from their account type. This includes content protected by parental controls or private library restrictions intended only for specific users. Once these identifiers are enumerated through repeated API calls, the attacker can subsequently stream the restricted media files directly. This results in a complete compromise of confidentiality for sensitive media assets and undermines the integrity of the access control model implemented by the system administrators. The ability to discover internal file paths also poses additional risks, as it may facilitate further attacks targeting server-side request forgery or local file inclusion if other vulnerabilities exist within the application stack.
This behavior aligns with MITRE ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials to access resources they are not authorized for, and potentially T1539 Steal Web Session Cookie if session manipulation is involved in bypassing checks, although here it relies on parameter omission rather than cookie theft. The vulnerability highlights the importance of strict input validation and explicit context resolution in web application development. To mitigate this issue, developers must ensure that all API endpoints enforce mandatory authentication contexts regardless of whether optional parameters are provided. Implementing a default deny policy where requests lacking required identifiers like userId are rejected with an appropriate error code rather than falling back to broader access rules is essential. Additionally, applying principle of least privilege and conducting regular security audits focused on authorization logic can prevent similar bypasses in other parts of the application ecosystem.