Description
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jellyfin | jellyfin | ≤ 12.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jellyfin | No fix yet | — |
References
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/PlaylistsController.cs#L177-L181 technical-description
- GitHub Security Advisory (GHSA-9x85-gx46-6522) related vendor-advisory
- https://abraxaslabs.tech/research/jellyfin-playlist-itemids third-party-advisory
- https://github.com/jellyfin/jellyfin product
- VulnCheck Advisory: Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId} third-party-advisory