Description
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jellyfin | jellyfin | ≤ 12.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jellyfin | No fix yet | — |
References
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/SuggestionsController.cs#L70-L95 technical-description
- GitHub Security Advisory (GHSA-9x85-gx46-6522) related vendor-advisory
- https://abraxaslabs.tech/research/jellyfin-suggestions-idor third-party-advisory
- https://github.com/jellyfin/jellyfin product
- VulnCheck Advisory: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions third-party-advisory