Authorization Bypass in Jellyfin Exposes Restricted Media

Executive Summary

Jellyfin through version 12.4 has an authorization bypass flaw in the SuggestionsController.GetSuggestions endpoint. Authenticated non-admin users can bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to list restricted items, including their IDs and server filesystem paths, and then stream them.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor GET requests to /Items/Suggestions without the userId parameter. Check server logs for repeated unauthorized access attempts to restricted content paths or IDs. Use network monitoring tools to inspect traffic for suspicious enumeration patterns targeting SuggestionsController endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access restricted media content, including sensitive or private files, by bypassing access controls. Attackers could enumerate and stream confidential data, potentially exposing personal information or violating privacy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected data, violating GDPR's data protection principles and HIPAA's security rules. It risks unauthorized disclosure of personal or health information, potentially resulting in legal penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Jellyfin to version 12.4 or later to patch the authorization bypass. If upgrading is not possible, restrict access to the /Items/Suggestions endpoint via firewall rules or reverse proxy configurations. Review and audit user permissions to ensure non-administrators cannot bypass restrictions.

Useful 0 Not Useful 0