CVE-2026-119550

CVE-2026-119550CVE-2026-119550

Description

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

Scoring

CVSS 3.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Last modified2026-10-30
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.