CVE-2026-119551

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

CVE-2026-119551 Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

CVE-2026-119551

Jellyfin versions through 12.4 are affected by an authorization bypass vulnerability in the SuggestionsController.GetSuggestions function. This flaw occurs because the application fails to properly validate the userId parameter, allowing authenticated non-administrator users to bypass library and...

EUVD-2026-113816

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

PT-2026-133489

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...