CVE-2022-35909: 
C# vulnerability analysis and mitigation

CVE-2022-35909 is a security vulnerability discovered in Jellyfin versions before 10.8.0, where the /users endpoint had incorrect access control for admin functionality. The vulnerability was discovered by Dan Barros and Eduardo Cardoso from Stolabs Security Research team and was disclosed in July 2022 (Stolabs Blog).

The vulnerability stems from an access control issue where unprivileged users could access the /users endpoint and list all registered users in the application, including identifying administrator accounts through the policy field. The vulnerability has a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allowed unprivileged users to access administrator panels and view sensitive user information. While users could access admin dashboards, they were initially restricted from making administrative changes due to token validation (Stolabs Blog).

The vulnerability was fixed in Jellyfin version 10.8.0. The fix included implementing proper authorization checks by adding the RequiresElevation policy to the affected endpoints (GitHub PR).