An information disclosure flaw in Jellyfin’s playlist API allows an authenticated user to obtain the GUIDs of hidden library items from public or shared playlists. By receiving these unfiltered identifiers, a user with restricted or parental controls can then stream media that should otherwise be inaccessible, leading to confidentiality compromise of protected content.

The issue affects Jellyfin media server deployments up through version 12.4. The vulnerability is present in the PlaylistsController handling GET requests to /Playlists/{playlistId} and can be exercised by any authenticated user who accesses public or shared playlists that include restricted items.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation requires network access to the server and user authentication, typically via a standard HTTP GET request. While no public exploits are known, the moderate impact and authenticated‑remote vector warrant immediate attention and remediation.