← Database

CVE-2026-119550

LOW CVSS: 3.5 Published: 2026-10-30 Modified: 2026-10-30

Description

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

Affected Platforms

Unknown

Weakness Type

CWE-862

References