Library access controls do not prevent API listing of all server content #4342

New Issue

OVERLORD · 2026-02-07T00:45:27+03:00

OVERLORD commented

2026-02-07 00:45:27 +03:00

Originally created by @thornbill on GitHub (Nov 9, 2022).

Originally assigned to: @Shadowghost on GitHub.

Please describe your bug

Limiting a user's access to libraries does not prevent them from discovering and listing the contents of all libraries on a server via the API. Similarly disabling live TV access does not prevent a user from listing all TV channels via the API.

Disable a user's access to all libraries and live TV in the admin dashboard.
Verify that the Policy returned by /Users/{USER_ID} includes:
- EnableAllFolders: false
- EnabledFolders: []
- EnableLiveTvAccess: false
Make a request to /Library/MediaFolders and observe that a list of ALL libraries are returned.
Using a library ID returned in the previous step, make a request to /Users/{USER_ID}/Items?ParentId={LIBRARY_ID} and observe that a list of ALL library contents are returned.
Make a request to /LiveTv/Channels and observe that a list of ALL channels are returned.

Jellyfin Version

likely all, tested on 10.8.1, 10.8.7, and unstable

Code of Conduct

I agree to follow this project's Code of Conduct

Originally created by @thornbill on GitHub (Nov 9, 2022). Originally assigned to: @Shadowghost on GitHub. ### Please describe your bug Limiting a user's access to libraries does not prevent them from discovering and listing the contents of all libraries on a server via the API. Similarly disabling live TV access does not prevent a user from listing all TV channels via the API. 1. Disable a user's access to all libraries and live TV in the admin dashboard. 2. Verify that the `Policy` returned by `/Users/{USER_ID}` includes: * `EnableAllFolders: false` * `EnabledFolders: []` * `EnableLiveTvAccess: false` 3. Make a request to `/Library/MediaFolders` and observe that a list of ALL libraries are returned. 4. Using a library ID returned in the previous step, make a request to `/Users/{USER_ID}/Items?ParentId={LIBRARY_ID}` and observe that a list of ALL library contents are returned. 5. Make a request to `/LiveTv/Channels` and observe that a list of ALL channels are returned. ### Jellyfin Version likely all, tested on 10.8.1, 10.8.7, and unstable ### Code of Conduct - [X] I agree to follow this project's Code of Conduct

OVERLORD added the bug security labels 2026-02-07 00:45:27 +03:00

OVERLORD closed this issue

2026-02-07 00:45:28 +03:00

OVERLORD commented

2026-02-07 00:45:29 +03:00

@VideoFX commented on GitHub (Nov 12, 2022):

Oh I got this too, i posted this before i noticed your post: https://github.com/jellyfin/jellyfin/issues/8730

@VideoFX commented on GitHub (Nov 12, 2022): Oh I got this too, i posted this before i noticed your post: https://github.com/jellyfin/jellyfin/issues/8730

OVERLORD commented

2026-02-07 00:45:31 +03:00

@Shadowghost commented on GitHub (May 15, 2023):

All ACL issues listed are fixed in current master.

@Shadowghost commented on GitHub (May 15, 2023): All ACL issues listed are fixed in current master.

OVERLORD referenced this issue

2026-02-07 06:12:56 +03:00

[PR #4342] [MERGED] Add BaseItemManager #10035

OVERLORD referenced this issue

2026-02-07 06:13:16 +03:00

[PR #4394] [CLOSED] BaseItemManager - 2 #10055

OVERLORD referenced this issue