CVE-2026-119550
Received Received - Intake

Information Disclosure in Jellyfin Media Server

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119550
EUVD
EUVD-2026-113815

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jellyfin jellyfin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jellyfin through version 12.4 has an information disclosure vulnerability in the PlaylistsController.GetPlaylist function. Authenticated users can read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

Impact Analysis

This vulnerability allows unauthorized users to access media they are not permitted to view, potentially exposing sensitive or restricted content. It could lead to privacy violations, data leaks, or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate compliance with GDPR, HIPAA, and other privacy regulations by enabling unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with data protection requirements.

Mitigation Strategies

Upgrade Jellyfin to a version later than 12.4 to address the information disclosure vulnerability in PlaylistsController.GetPlaylist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119550. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart