CVE-2026-119551 Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119551?
CVE-2026-119551 is a high-severity vulnerability in jellyfin, published on 30 Oct 2026.
Official description
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Weakness: CWE-862
Which versions are affected by CVE-2026-119551?
How do I fix CVE-2026-119551?
No fix has been published for CVE-2026-119551 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119551 being exploited?
There is no known exploitation of CVE-2026-119551 in the wild and no public exploit code.
Sources
Also known as GHSA-72f8-2q8j-rxmr.