CVE-2026-119550: 
Wolfi vulnerability analysis and mitigation

CVE-2026-119550 is an information disclosure vulnerability in Jellyfin's PlaylistsController.GetPlaylist endpoint affecting Jellyfin through version 12.4. Authenticated users — including those with restricted or parental-control limitations — can request public or shared playlists and receive unfiltered ItemIds (GUIDs) for library items they are not authorized to access, then use those GUIDs to stream hidden or restricted media. The vulnerability was published on October 30, 2026, and assigned a CVSS v3.1 score of 3.5 (Low) and a CVSS v4.0 score of 5.1 (Medium) (Github Advisory, Feedly).

The root cause is a missing authorization check (CWE-862) in the GetPlaylist action of PlaylistsController.cs (lines 177–181 in v12.4). When a caller requests a public or shared playlist via GET /Playlists/{playlistId}, the controller returns a PlaylistDto containing ItemIds populated from playlist.GetManageableItems() without filtering those items against the requesting user's library access permissions or parental controls. As a result, a restricted user who can legitimately view the playlist metadata receives the raw GUIDs of all playlist items, including those in libraries they are blocked from accessing, and can subsequently use those GUIDs to initiate media streams (PlaylistsController source, Github Advisory). A related advisory (GHSA-9x85-gx46-6522) also documents an IDOR in the /Playlists/{playlistId}/Items endpoint where the userId query parameter is accepted without verifying the caller's right to act as that user, enabling cross-user private playlist enumeration (Jellyfin Security Advisory).

Successful exploitation allows restricted or parental-controlled Jellyfin users to enumerate GUIDs of media library items they should not have access to, and then stream that hidden or restricted content. The impact is limited to confidentiality — there is no integrity or availability impact — and is scoped to the vulnerable Jellyfin server instance. In multi-user family or organizational deployments, this effectively bypasses parental controls and library access restrictions, exposing age-restricted or otherwise hidden media to unauthorized users (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated account on the target Jellyfin instance, limiting the attacker pool to existing users (Github Advisory).

1. Authenticate: Log in to the target Jellyfin instance using any valid user account, including a restricted or parental-controlled account.
2. Identify a public or shared playlist: Browse or enumerate playlists that are publicly accessible or shared with the attacker's account. Playlist IDs (GUIDs) can be discovered via the Jellyfin web UI or by querying GET /Playlists.
3. Request the playlist details: Send an authenticated HTTP GET request to GET /Playlists/{playlistId} (e.g., GET http://<server>:8096/Playlists/<playlistId>).
4. Extract hidden ItemIds: Parse the returned PlaylistDto JSON response and collect the ItemIds array, which contains GUIDs of all playlist items — including those in libraries the attacker's account cannot normally access.
5. Stream restricted media: Use the obtained GUIDs to request media streams via standard Jellyfin playback endpoints (e.g., GET /Items/{itemId}/Download or /Videos/{itemId}/stream), bypassing library access controls and parental restrictions (PlaylistsController source, Github Advisory).

• Network: Repeated authenticated GET /Playlists/{playlistId} requests from restricted user accounts, particularly to playlists not owned by or explicitly shared with that user; subsequent playback or download requests (/Items/{itemId}/stream, /Videos/{itemId}/stream) for items in libraries the user should not access.
• Logs: Jellyfin access logs showing a restricted or parental-controlled user account requesting playlist endpoints followed by streaming requests for media items outside their permitted libraries; mismatches between a user's library access configuration and the item IDs they are streaming.
• Application Behavior: Parental-controlled or restricted accounts successfully initiating playback of content from restricted libraries without triggering access-denied responses.

Upgrade Jellyfin to a version newer than 12.4, which includes a patch that filters playlist ItemIds against the requesting user's library access permissions before returning them in the API response (Github Advisory). No configuration-based workaround is available for the GetPlaylist endpoint vulnerability. As interim measures, administrators should review playlist configurations to ensure public or shared playlists do not contain items from restricted libraries, and audit user access logs to identify whether restricted users have accessed unauthorized media through playlist enumeration (Feedly).