CVE-2022-36223: 
Homebrew vulnerability analysis and mitigation

In Emby Server version 4.6.7.0, a stored Cross-Site Scripting (XSS) vulnerability was discovered in the playlist name field. This vulnerability, tracked as CVE-2022-36223, was identified and could potentially lead to administrator account takeover (Medium Blog).

The vulnerability exists in the playlist name field where user input is not properly sanitized, allowing for the injection of malicious JavaScript code. When an administrator views the playlist, the stored XSS payload executes in their browser context, enabling the theft of sensitive information including the administrator's access token and user ID (Medium Blog).

The vulnerability allows an attacker to steal the administrator's access token and user ID, which can be leveraged to create new administrator accounts on the media server. This effectively enables complete administrative control over the Emby Server installation (Medium Blog).

Users should upgrade from Emby Server version 4.6.7.0 to a patched version. Server administrators should also regularly review user permissions and monitor for unauthorized administrative account creation (Medium Blog).