Jellyfin EUVD-2026-113816

Requires a valid authenticated non-administrator account on a Jellyfin server at or below version 12.4; the attacker then calls GET /Items/Suggestions while omitting the userId query parameter, which causes the SuggestionsController.GetSuggestions handler to skip per-user library and parental-control authorization. Limiting factors: exploitation needs a pre-existing low-privilege account (PR:L) - it is not available to fully unauthenticated attackers - and impact is confined to reading/enumerating and streaming restricted items plus disclosure of item IDs and server filesystem paths; no user interaction, admin rights, or non-default configuration is required.

The signals converge on a genuine but bounded priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw needing only a valid low-privilege (non-admin) account and no user interaction, which matches the description of an authenticated non-administrator omitting the userId parameter. Impact is confidentiality-only (VC:H, VI:N, VA:N): attackers read and stream restricted library items and learn item IDs and server filesystem paths, with no integrity or availability effect, which is why the score lands at 7.1 rather than critical. There is no KEV listing and no EPSS score in the provided data, so active-exploitation and widespread-probability signals are absent; exploitation status here is best described as a public PoC reference existing rather than confirmed exploitation. The vuln.today decision label is 'this_week', consistent with a real vulnerability that warrants prompt patching but is not flagged emergency. Net: a legitimate authorization-bypass worth remediating this week, tempered by the authenticated-account prerequisite and the read-only impact - not a high-CVSS-but-trivial issue, but also not an unauthenticated internet-wide emergency.

A user holding a restricted (e.g. parental-controls or limited-library) account on a Jellyfin server through 12.4 repeatedly sends GET /Items/Suggestions with the userId parameter omitted, causing the server to apply no per-user authorization and return items the account should not see - including IDs and filesystem paths - which the attacker then streams. A public PoC reference exists (abraxaslabs research and the VulnCheck advisory); it is not verified as working exploit code. Exploitation is low-complexity (AC:L) but requires a pre-existing authenticated account (PR:L).