Jellyfin instances running version 12.4 or earlier are vulnerable to an authorization bypass in the SuggestionsController.GetSuggestions endpoint. The flaw allows any authenticated user who is not an administrator to omit the required userId parameter and invoke GET /Items/Suggestions. This release of the request enumerates all library items that the user normally cannot see, exposing item identifiers and server filesystem paths, and permits the user to stream those restricted items. The vulnerability therefore enables unauthorized access to secret or restricted media and the discovery of internal server information.

All Jellyfin deployments using the jellyfin:jellyfin product up to and including version 12.4. Users deploying this open‑source media platform should verify their installed release; any build with an unpatched jellyfin core before 12.5 is affected.

The CVSS score of 7.1 indicates a medium to high risk profile, and the vulnerability can be exploited over the network by any authenticated user. The EPSS score is not available, but the lack of a special privilege requirement and freedom to repeat the request suggest a reasonable potential for exploitation in environments with many users. The vulnerability is not currently listed in the CISA KEV catalog, but should be treated as a high‑priority issue due to its impact on confidentiality and integrity of media assets.