starred/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2026-07-16 05:43:54 +03:00
Code Issues 822 Packages Projects Releases 17 Wiki Activity

[Issue]: SessionController permissions #5610

New Issue
Closed
opened 2026-02-07 02:00:01 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-07 02:00:01 +03:00
Owner
Copy Link

Originally created by @bin101 on GitHub (Apr 16, 2024).

Please describe your bug

A user can see every session of every user if they do not provide their own user ID as a query parameter. Instead, it is assumed that the user has administrator rights.

Noticed this as a friend of mine said he can see every session via his homarr dashboard.

Reproduction Steps

  1. Create a user without admin rights
  2. Ask for all sessions via curl
  3. Profit

Jellyfin Version

10.8.13

if other:

No response

Environment

n/a

Jellyfin logs

n/a

FFmpeg logs

No response

Please attach any browser or client logs here

No response

Please attach any screenshots here

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct
Originally created by @bin101 on GitHub (Apr 16, 2024). ### Please describe your bug A user can see every session of every user if they do not provide their own user ID as a query parameter. Instead, it is assumed that the user has administrator rights. Noticed this as a friend of mine said he can see every session via his homarr dashboard. ### Reproduction Steps 1. Create a user without admin rights 2. Ask for all sessions via curl 3. Profit ### Jellyfin Version 10.8.13 ### if other: _No response_ ### Environment ```markdown n/a ``` ### Jellyfin logs ```shell n/a ``` ### FFmpeg logs _No response_ ### Please attach any browser or client logs here _No response_ ### Please attach any screenshots here _No response_ ### Code of Conduct - [X] I agree to follow this project's Code of Conduct
OVERLORD added the bugconfirmedsecuritybreaking change: web api labels 2026-02-07 02:00:02 +03:00
OVERLORD commented 2026-02-07 02:00:05 +03:00
Author
Owner
Copy Link

@jellyfin-bot commented on GitHub (Apr 16, 2024):

Hi, it seems like your issue report has the following item(s) that need to be addressed:

  • The format of the environment section has been altered from the template.

This is an automated message, currently under testing. Please file an issue here if you encounter any problems.

@jellyfin-bot commented on GitHub (Apr 16, 2024): Hi, it seems like your issue report has the following item(s) that need to be addressed: - The format of the environment section has been altered from the template. This is an automated message, currently under testing. Please file an issue [here](https://github.com/jellyfin/jellyfin-triage-scripts/issues) if you encounter any problems.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
EFjellyfin.db
area:database
awaiting-feedback
backend
blocked
breaking change: web api
bug
build
ci
confirmed
discussion needed
dotnet future
downstream
duplicate
enhancement
feature
future
github-actions
good first issue
hdr
help wanted
invalid
investigation
librarydb
live-tv
lyrics
media playback
music
needs testing
nuget
performance
platform
pull-request
Mirrored from GitHub Pull Request
 question
regression
release critical
requires-web
roadmap
security
security
stale
support
syncplay
ui & ux
upstream
wontfix
No Label breaking change: web api bug confirmed security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/jellyfin#5610
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?