Jellyfin CVE-2026-119550

Requires a valid authenticated account on the target Jellyfin instance - specifically a low-privilege, restricted, or parental-controlled user (PR:L). The target playlist must be public or shared and must contain items the requesting user is not authorized to access; the GetPlaylist response then returns those ItemId GUIDs without applying the user's library/parental-control filtering. Limiting factors: exploitation yields only item GUIDs (low confidentiality impact, no integrity/availability effect) and is bounded to media reachable through accessible shared/public playlists; it provides no benefit to an unauthenticated attacker and does not affect a deployment with no shared playlists containing restricted content. Note the referenced GHSA variant instead requires appending a victim userId to the /Playlists/{playlistId}/Items request - this trigger differs from the CVE description and is not independently reconciled in the available sources.

This is a moderate-priority authorization flaw, not a high-urgency emergency. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) describes a network-reachable, low-complexity issue exploitable by an already-authenticated low-privilege user, with only low confidentiality impact (VC:L) and no integrity or availability impact - consistent with CWE-862 (missing authorization). The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which aligns with the limited confidentiality-only impact. No CISA KEV listing and no EPSS score were provided, so widespread or active exploitation is not indicated; however, the references include a dedicated research write-up (abraxaslabs.tech) and a vendor security advisory, so a public PoC reference exists even though it is not verified as working exploit code. The most significant caveat is a source conflict: the linked GHSA advisory (GHSA-9x85-gx46-6522) describes a userId-query-parameter IDOR fixed in v12.0, whereas the CVE description and EUVD describe an unfiltered-ItemIds disclosure in GetPlaylist affecting Jellyfin 'through 12.4' - the mechanism and the affected/fixed version ranges disagree and must be verified with the vendor. Net real-world risk: a bounded parental-control / library-access bypass that leaks item GUIDs and enables streaming of otherwise-restricted media, meaningful for shared/family deployments but not a mass-exploitation threat.

A restricted or parental-controlled Jellyfin account (for example a child profile) authenticates and requests a public or shared playlist via the GetPlaylist endpoint, which returns ItemIds without filtering them against that user's library permissions. The attacker harvests the GUIDs of items they are not allowed to see and then streams that hidden media directly by ID. A public PoC reference exists (abraxaslabs research and the vendor GHSA advisory); it is not verified as working exploit code.