CVE-2026-119550

LOW 3.5

Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.

CWE	CWE-862
Vendor	jellyfin
Product	jellyfin
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for jellyfin jellyfin

Be the first to know when new low vulnerabilities affecting jellyfin jellyfin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

jellyfin / jellyfin

0 ≤ 12.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/PlaylistsController.cs#L177-L181 github.com: https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522 abraxaslabs.tech: https://abraxaslabs.tech/research/jellyfin-playlist-itemids github.com: https://github.com/jellyfin/jellyfin vulncheck.com: https://www.vulncheck.com/advisories/jellyfin-through-12.4-information-disclosure-via-get-playlists-playlistid

Credits

Abraxas Labs