Description
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jellyfin jellyfin
Default version status: unaffected
0 to ≤ 12.4affected
pkg:github/jellyfin/jellyfinReferences
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/SuggestionsController.cs#L70-L95 ↗
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522 ↗
- https://abraxaslabs.tech/research/jellyfin-suggestions-idor ↗
- https://github.com/jellyfin/jellyfin ↗
- https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions ↗