GetUser() endpoint (UserController) is fully unauthenticated #6958

New issue

Open

opened 2025-12-22 05:02:12 +01:00 by backuprepo · 0 comments

backuprepo commented

2025-12-22 05:02:12 +01:00

Owner

Originally created by @felix920506 on GitHub (Apr 23, 2025).

split from #5415

Allows an attacker with knowledge of user id's (easily retrievable for authenticated users due to open /Users endpoint, see above) to get the entire user configuration for a given user, potentially containing sensitive or private information. Examples include the authentication provider, last login dates as well as bruteforce login information (login attempt counters).
Potential fix: Require user privileges on this endpoint. Better would be to only allow users to retrieve their own data, only admins should have the ability to see all users. See below for issues relating to per-user authentication.

Originally created by @felix920506 on GitHub (Apr 23, 2025). split from #5415 Allows an attacker with knowledge of user id's (easily retrievable for authenticated users due to open /Users endpoint, see above) to get the entire user configuration for a given user, potentially containing sensitive or private information. Examples include the authentication provider, last login dates as well as bruteforce login information (login attempt counters). Potential fix: Require user privileges on this endpoint. Better would be to only allow users to retrieve their own data, only admins should have the ability to see all users. See below for issues relating to per-user authentication.

backuprepo added the

security

bug

labels 2025-12-22 05:02:12 +01:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#6958

No description provided.

Rows
Columns