CVE-2026-119551 Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...