GetUsers() endpoint (UserController) only requires user privileges #6959

New issue

Open

opened 2025-12-22 05:02:12 +01:00 by backuprepo · 0 comments

backuprepo commented

2025-12-22 05:02:12 +01:00

Owner

Originally created by @felix920506 on GitHub (Apr 23, 2025).

split from #5415

Allows listing of any user, id included, on the server, not limited to public users. Can leverage massively more invasive attacks due to further issues with user id authentication, see below.
Potential fix: Require admin privileges on this endpoint

Originally created by @felix920506 on GitHub (Apr 23, 2025). split from #5415 Allows listing of any user, id included, on the server, not limited to public users. Can leverage massively more invasive attacks due to further issues with user id authentication, see below. Potential fix: Require admin privileges on this endpoint

backuprepo added the

security

bug

labels 2025-12-22 05:02:12 +01:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#6959

No description provided.

Rows
Columns