Is CVE-2026-119551 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119551?

CVE-2026-119551 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-119551

Description

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.