An elevated‑permission GitHub Actions workflow named code-quality.yml in the jellyfin/jellyfin-ios repository allows arbitrary code execution when a pull request originates from a forked repository. This flaw enables a malicious actor to run code with high‑level permissions, leading to a full takeover of the repository, exfiltration of privileged secrets, and the potential for supply‑chain attacks on the Apple App Store build and package poisoning in GitHub Container Registry. The weakness represents a privilege escalation due to improper workflow configuration (CWE‑269).

The vulnerability exists in the code-quality.yml workflow used by the jellyfin organization on GitHub. It does not target a particular software version, so any use of this workflow in the jellyfin/jellyfin-ios repository is affected. End users of the iOS client do not need to take action, but maintainers of the repository must review workflow permissions.

The flaw carries a maximum severity score of 10, indicating the highest damage potential if exploited. An estimated exploit probability is below 1%, suggesting that active attacks have not been observed yet. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog, which further implies limited public exploitation. The attack vector can be inferred to be a pull request from a forked repository that triggers the workflow, requiring only the ability to create such a PR. Once the workflow runs, the attacker can obtain repository administration rights and confidential secrets.