Threats affecting pkg:github/jellyfin

Jellyfin versions up to 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. Authenticated non-administrator users can omit the userId parameter in requests to bypass library and parental restrictions. This allows attackers to enumerate restricted media items, including their IDs and server filesystem paths, and stream them without proper authorization.

CVE-2026-119550 is an information disclosure vulnerability in Jellyfin versions up to 12.4. It allows authenticated users, including restricted or parental-controlled accounts, to access hidden item IDs from public or shared playlists. This can lead to unauthorized streaming of media that should be inaccessible.

Jellyfin versions up to 12.4 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass the SvgSecurityValidator by embedding gzip-compressed SVG content within non-SVG image data URIs. This enables attackers to upload malicious profile images via the POST /UserImage endpoint and then trigger unauthenticated rendering through GET /UserImage, potentially fetching internal URLs, reading local image files, or causing memory exhaustion.