Which versions of Jellyfin are affected by CVE-2026-35032?

Jellyfin media server versions before 10.11.7 contain a privilege escalation vulnerability that allows any authenticated user to gain full administrative control by exploiting a chained vulnerability…. A patch is available.

How to fix or mitigate CVE-2026-35032?

Within 24 hours: Identify all Jellyfin instances in your environment and document their current versions. Within 7 days: Upgrade all Jellyfin installations to version 10.11.7 or later per vendor advisory. Within 30 days: Audit Jellyfin access logs for suspicious activity and review all user accounts with EnableLiveTvManagement permissions; restrict this permission to administrative users only.

Jellyfin CVE-2026-35032

Q: What is the CVSS score of CVE-2026-35032?

CVE-2026-35032 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22766 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-14 GitHub_M

SSRF Jellyfin

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:03 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.11.7

Analysis Generated

Apr 15, 2026 - 01:08 vuln.today

CVSS changed

Apr 14, 2026 - 23:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 14, 2026 - 22:46 euvd

EUVD-2026-22766

Analysis Generated

Apr 14, 2026 - 22:46 vuln.today

CVE Published

Apr 14, 2026 - 22:25 nvd

HIGH 8.6

DescriptionGitHub Advisory

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users.

AnalysisAI

Jellyfin media server versions before 10.11.7 allow authenticated users to escalate privileges to administrator through a chained exploit involving M3U tuner SSRF, local file read, and database exfiltration. Any authenticated user can exploit this because the EnableLiveTvManagement permission defaults to enabled. The attack chain enables reading the Jellyfin database to extract admin session tokens, achieving full administrative control. CVSS 8.6 (High) reflects network-accessible attack requiring only low-privilege authentication. No active exploitation (CISA KEV) confirmed, but public disclosure via GitHub Security Advisory indicates exploit details are known.

Technical ContextAI

The vulnerability chain targets Jellyfin's LiveTV M3U tuner functionality, specifically the POST /LiveTv/TunerHosts endpoint. This endpoint accepts user-supplied URLs for M3U playlist sources but fails to validate the URL scheme, permitting both file:// URIs (local file read) and HTTP/HTTPS URLs (SSRF). The root cause is CWE-918 (Server-Side Request Forgery), where the application makes requests to attacker-controlled destinations. M3U playlists are text files listing media stream URLs; by crafting a malicious M3U file that references the Jellyfin SQLite database path, an attacker can leverage the tuner's playlist parsing to read arbitrary local files. The EnableLiveTvManagement permission, which controls access to this endpoint, is insecurely defaulted to true for all newly created users, violating the principle of least privilege. Affected product identified via CPE: cpe:2.3:a:jellyfin:jellyfin versions prior to 10.11.7.

RemediationAI

Upgrade immediately to Jellyfin version 10.11.7 or later, which addresses the vulnerability chain by implementing proper URL validation in the M3U tuner endpoint and correcting the EnableLiveTvManagement permission defaults. Release v10.11.7 available at https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7. If immediate upgrade is not feasible, implement the workaround by disabling Live TV Management privileges for all user accounts through the Jellyfin admin dashboard under Users > [select user] > Enable Live TV Management (uncheck). This prevents exploitation but disables legitimate LiveTV tuner management functionality. Audit existing M3U tuners for suspicious entries pointing to local file paths or unexpected external URLs, and review admin session activity logs for unauthorized privilege escalation attempts. After upgrading, regenerate all API keys and admin session tokens as a precautionary measure.