Information Disclosure in Jellyfin Media Server by Jellyfin
CVE-2026-119550

5.1MEDIUM

Key Information:

Vendor

Jellyfin

Status
Jellyfin
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119550?

Jellyfin Media Server versions up to 12.4 are susceptible to an information disclosure flaw in the PlaylistsController.GetPlaylist endpoint. Authenticated users can exploit this vulnerability by accessing public or shared playlists to retrieve hidden item IDs. This allows users with restricted or parental controls to uncover GUIDs of items in the library that should be inaccessible, enabling them to potentially stream media that falls outside their permissions.

Affected Version(s)

jellyfin 0 <= 12.4

References

https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin....
technical-description
https://github.com/jellyfin/jellyfin/security/advisories/...
relatedvendor-advisory
https://abraxaslabs.tech/research/jellyfin-playlist-itemids
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.