Selfhosted

I don't think downplaying them is the way to go though, Some of these issues have been in existence since 2019.

Like I mentioned though, it does seem like its starting to be worked on, a few of them are in progress the one I really don't like is #13991 which is a combination of:

• #13982 which allows for an alternative user to be able to interact with the client readonly as if they are another user as long as they have the user id and any valid auth token (which includes that current users auth token). original issue: #5210 2/10/2021; status: partially mitigated 5/11/24 with v10.9 which locked modifying data behind elevation but getting the data still is able to be done in select endpoints still
• and #13990 Which gives any user with standard login access(like say the common family tv's account) the ability to access the getUser endpoint and retrieve said previous user id. In progress since 12/2/25 reported via the megathread creation 3/8/2021

For example I just made a user with no access period to any collection, just a login access and took the auth token for the user. I was able to grab every user on the servers ID including hidden and administrative users as well as users who don't use jellyfin's auth system, then couple that to see what the users login method was, when their last access was, what folders they were allowed to use[note these are represented as id's the client can't actually parse them so you need to traverse the api for it], how many max sessions they could have, etc. without actually having access or logging in as that user or even being an administrator. If you snag an admins userid it even gives you internal server data such as logging paths that the server uses on the dashboard, the transcode path, the metadata path, what networking settings the server is using such as trusted ip nets the port jellyfin is using by default your certificate file and password if configured[although password may be ommited/the field left blank i didn't test internal certs]. From there you can even recurse through the folder UUID's provided via "enabledfolders" and the other folder restrictions on the users endpoint and get the name of the folders which could leak personal information about the library or the user because the 403 request it returns leaks the name of the library as part of the error message. "username is not allowed to access Library name"

Thankfully it's finally being worked on but, I do think it's worth stating the timeframe on them and that those issues do still exist.

Just like I think it's worth stating that media endpoints are still fully unauthenticated as well, so as long as you can guess the full file path, you can md5 it and get unauthenticated media paths, but that's in progress as well, its just super slow because that breaks third party clients.