CVE-2026-119551: 
Wolfi vulnerability analysis and mitigation

CVE-2026-119551 is an authorization bypass vulnerability in Jellyfin's SuggestionsController.GetSuggestions endpoint that allows authenticated non-administrator users to circumvent library and parental restrictions. By omitting the userId query parameter when calling GET /Items/Suggestions, the controller falls back to a null user context, bypassing all access controls. All Jellyfin versions through 12.4 are affected. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High), and was published on October 30, 2026 (Github Advisory, Feedly).

The root cause is a missing authorization check (CWE-862) in SuggestionsController.GetSuggestions (Jellyfin.Api/Controllers/SuggestionsController.cs, lines 70–95). When userId is omitted from the query string, the controller sets user = null and passes it directly to _libraryManager.GetItemsResult(new InternalItemsQuery(user) {...}), which then executes without any user-scoped library or parental control filtering. An attacker with any valid Jellyfin account can exploit this over the network with low complexity and no user interaction by repeatedly issuing GET /Items/Suggestions without a userId parameter to enumerate all library items regardless of restrictions (SuggestionsController Source, Github Advisory).

Successful exploitation allows any authenticated non-administrator user to enumerate restricted media library items — including their item IDs and server filesystem paths — and then stream content that should be blocked by library access controls or parental restrictions. The impact is limited to confidentiality (no integrity or availability impact), but the exposure of server filesystem paths could facilitate further reconnaissance or attacks against the underlying host. Environments using Jellyfin's parental controls or per-user library restrictions to enforce content separation between users are most at risk (Github Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of publication. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires only a valid (non-administrator) Jellyfin account, making it accessible to any registered user on a multi-user instance (Github Advisory, Feedly).

1. Authenticate: Obtain any valid non-administrator Jellyfin account on the target server (e.g., a standard user account or a free trial/guest account if enabled).
2. Identify the target endpoint: Locate the Jellyfin server's API base URL (default: http://<server>:8096).
3. Craft the malicious request: Issue a GET request to /Items/Suggestions while deliberately omitting the userId parameter and including a valid authentication token or API key in the header:

   GET /Items/Suggestions?mediaType=Video&type=Movie HTTP/1.1
   Host: <jellyfin-server>:8096
   X-Emby-Token: <valid_user_token>

4. Enumerate restricted items: Parse the JSON response to collect item IDs, titles, and server filesystem paths for all library items, including those restricted by parental controls or library access rules.
5. Stream restricted content: Use the retrieved item IDs to request media streams via the standard Jellyfin streaming API (e.g., GET /Videos/{itemId}/stream) with the same authenticated token, bypassing content restrictions (SuggestionsController Source, Github Advisory).

• Network: Repeated GET /Items/Suggestions requests from non-administrator user tokens that lack a userId query parameter; unusual volume of streaming requests (/Videos/{itemId}/stream) from accounts that should not have access to certain content.
• Logs: Jellyfin access logs showing GET /Items/Suggestions calls without a userId parameter from standard user accounts, especially in rapid succession or at unusual hours; streaming activity for items outside a user's assigned library.
• Behavioral: A non-administrator account accessing media items from libraries or content categories explicitly excluded from their profile; API calls returning large item sets inconsistent with the user's configured library access.

Update Jellyfin to a version beyond 12.4, which addresses the missing authorization check in SuggestionsController.GetSuggestions. No official workaround is available for unpatched versions; however, administrators can review access logs for suspicious GET /Items/Suggestions API calls from non-administrator users and consider implementing network-level controls (e.g., firewall rules or reverse proxy authentication) to restrict API access to trusted users. Disabling or restricting user account creation can reduce the attack surface on multi-user instances (Github Advisory, Feedly).