Description
In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Jellyfin.Common | < 10.8.0 | 10.8.0 | GHSA-qwp3-5fw3-5wgv |
High · 8.8
CVE-2022-35909
EUVD-2022-6613GHSA-qwp3-5fw3-5wgv
Incorrect Access Control and Cross Site Scripting in Jellyfin
Published Aug 19, 2022 · Updated Aug 3, 2024 · Assigned by mitre