starred/jellyfin

Fork 0

mirror of https://github.com/jellyfin/jellyfin.git synced 2026-01-23 23:20:51 +01:00

Roku 1.6 Access controls are broken. Leaking restricted search results. #4349

New issue

Open

opened 2025-12-21 23:51:17 +01:00 by backuprepo · 5 comments

backuprepo commented

2025-12-21 23:51:17 +01:00

Owner

Originally created by @VideoFX on GitHub (Nov 12, 2022).

Please describe your bug

Describe the bug
For Jellyfin Roku 1.6. The search function is allowing users without access to libraries to see the results of the restricted libraries. However, on other apps such as web browser and android, the access controls are working as expected.

To Reproduce
Search for something you are not supposed to have access to.

Server:
Ubuntu 20.04
Jellyfin.Server 10.8.7.0

Client:
Roku Jellyfin 1.6

Jellyfin Version

10.8.0

if other:

10.8.7.0

Environment

- OS: Ubuntu 20.04
- Virtualization: Xen
- Clients: Roku Jellyfin 1.6

Jellyfin logs

No response

FFmpeg logs

No response

Please attach any browser or client logs here

No response

Please attach any screenshots here

No response

Code of Conduct

I agree to follow this project's Code of Conduct

Originally created by @VideoFX on GitHub (Nov 12, 2022). ### Please describe your bug Describe the bug For Jellyfin Roku 1.6. The search function is allowing users without access to libraries to see the results of the restricted libraries. However, on other apps such as web browser and android, the access controls are working as expected. To Reproduce Search for something you are not supposed to have access to. Server: Ubuntu 20.04 Jellyfin.Server 10.8.7.0 Client: Roku Jellyfin 1.6 ### Jellyfin Version 10.8.0 ### if other: 10.8.7.0 ### Environment ```markdown - OS: Ubuntu 20.04 - Virtualization: Xen - Clients: Roku Jellyfin 1.6 ``` ### Jellyfin logs _No response_ ### FFmpeg logs _No response_ ### Please attach any browser or client logs here _No response_ ### Please attach any screenshots here _No response_ ### Code of Conduct - [X] I agree to follow this project's Code of Conduct

backuprepo added the

security

bug

labels 2025-12-21 23:51:17 +01:00

backuprepo commented

2025-12-21 23:51:18 +01:00

Author

Owner

@VideoFX commented on GitHub (Nov 12, 2022):

Maybe the reason, or related security issue: https://github.com/jellyfin/jellyfin/issues/8718

@VideoFX commented on GitHub (Nov 12, 2022): Maybe the reason, or related security issue: https://github.com/jellyfin/jellyfin/issues/8718

backuprepo commented

2025-12-21 23:51:20 +01:00

Author

Owner

@anthonylavado commented on GitHub (Jan 8, 2023):

Looks like the latest release of 10.8.8 had at least a partial fix of this issue. I believe the only thing it doesn't cover is Live TV. Can you check and see if it's working as expected?

@anthonylavado commented on GitHub (Jan 8, 2023): Looks like the latest release of 10.8.8 had at least a partial fix of this issue. I believe the only thing it doesn't cover is Live TV. Can you check and see if it's working as expected?

backuprepo commented

2025-12-21 23:51:23 +01:00

Author

Owner

@VideoFX commented on GitHub (Jan 8, 2023):

I can confirm it is not working. The new version still leaks search results for movies, and access restrictions are still circumvented. It is most easily observed when using the Jellyfin roku app (which I was told uses the api slightly differently compared to the web version). However, access restriction works for the web version. I never observed a problem with access restrictions when using web browser.

@VideoFX commented on GitHub (Jan 8, 2023): I can confirm it is not working. The new version still leaks search results for movies, and access restrictions are still circumvented. It is most easily observed when using the Jellyfin roku app (which I was told uses the api slightly differently compared to the web version). However, access restriction works for the web version. I never observed a problem with access restrictions when using web browser.

backuprepo commented

2025-12-21 23:51:25 +01:00

Author

Owner

@StevenAlexander44 commented on GitHub (Jan 25, 2023):

Still an issue in 10.8.9

@StevenAlexander44 commented on GitHub (Jan 25, 2023): Still an issue in 10.8.9

backuprepo commented

2025-12-21 23:51:26 +01:00

Author

Owner

@surepointit commented on GitHub (Feb 17, 2023):

Can confirm same issue here.

Roku app 1.6 build 3

Jellyfin server 10.8.9

@surepointit commented on GitHub (Feb 17, 2023): Can confirm same issue here. Roku app 1.6 build 3 Jellyfin server 10.8.9

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#4349

No description provided.

Rows
Columns