# CVE-2026-119551: Jellyfin authorization bypass in SuggestionsController.GetSuggestions

Source: https://junglewise.ai/threats/cve-2026-119551-jellyfin-through-12-4-contains-an-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119551 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Jellyfin is a free media server that allows users to stream video, music, and photos. An authenticated user without administrator privileges can bypass library and parental controls by making requests without a user ID parameter, allowing them to enumerate and stream restricted media content.

Technologies: [Jellyfin](https://junglewise.ai/threats/technologies/jellyfin). Vendors: [Jellyfin](https://junglewise.ai/threats/vendors/jellyfin).

## Quick answers

**Is CVE-2026-119551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119551 being exploited in the wild.

**How severe is CVE-2026-119551?** Medium severity, with a CVSS score of 6.5, published 30 October 2026.

**Which products and versions are affected?** Jellyfin through 12.4.

**Is there a fix for CVE-2026-119551?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119551 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-119551?** Check whether you run Jellyfin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SuggestionsController.GetSuggestions endpoint fails to properly enforce authorization checks when the userId parameter is omitted. An authenticated non-administrator user can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including their IDs and server filesystem paths. This allows attackers to access media that should be restricted by library or parental control settings and subsequently stream it.

## Affected products

- Jellyfin Jellyfin through 12.4

## Timeline

- 2026-10-30: disclosed

## References

- [https://abraxaslabs.tech/research/jellyfin-suggestions-idor](https://abraxaslabs.tech/research/jellyfin-suggestions-idor)
- [https://github.com/jellyfin/jellyfin](https://github.com/jellyfin/jellyfin)

## Related threats

- [Jellyfin path traversal in virtual folder endpoints](https://junglewise.ai/threats/cve-2026-126499-jellyfin-before-12-0-contains-a-path-traversal-vulnerability-in)
- [Jellyfin server-side request forgery in SvgSecurityValidator](https://junglewise.ai/threats/cve-2026-119549-jellyfin-through-12-4-contains-a-server-side-request-forgery)
- [Jellyfin path traversal in ClientLog Document endpoint](https://junglewise.ai/threats/cve-2026-49247-jellyfin-path-traversal-in-clientlog-document-endpoint)
- [Jellyfin path traversal in MKV attachment extraction](https://junglewise.ai/threats/cve-2026-49246-jellyfin-path-traversal-in-mkv-attachment-extraction)
- [Jellyfin stored XSS in user management dashboard via Client header](https://junglewise.ai/threats/cve-2026-49220-jellyfin-stored-xss-in-user-management-dashboard-via-client)