Threats tagged 'ghsa-72f8-2q8j-rxmr'

Jellyfin versions through 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. This flaw allows authenticated users without administrator privileges to bypass library and parental restrictions by omitting the userId parameter in requests. Exploitation enables attackers to enumerate restricted items, including their IDs and server filesystem paths, and stream those items without proper authorization.