Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…llyfin/security/advisories/GHSA-9x85-gx46-6522 Üretici bülteni
• abraxaslabs.tech/research/jellyfin-suggestions-idor Üçüncü taraf
• vulncheck.com/…authorization-bypass-via-get-items-suggestions Üçüncü taraf
• github.com/…lyfin.Api/Controllers/SuggestionsController.cs Diğer
• github.com/jellyfin/jellyfin Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:31Yayımlandı

İlgili açıklar

• 3,5 CVE-2026-119550Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
• 7,1 CVE-2026-119549Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
• 4,3 CVE-2026-119556Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
• 7,5 CVE-2026-110732AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account T…
• 4,3 CVE-2026-119059Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'p…
• 4,3 CVE-2026-119087Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter