CVE-2026-119550

EUVD-2026-113815
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
jellyfinjellyfin
𝑥
≤ 12.4
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/jellyfin-playlist-itemids
https://github.com/jellyfin/jellyfin
https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/PlaylistsController.cs#L177-L181
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522
https://www.vulncheck.com/advisories/jellyfin-through-12.4-information-disclosure-via-get-playlists-playlistid