How severe is CVE-2026-31852?

CVE-2026-31852 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-31852 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-31852?

CVE-2026-31852 affects Jellyfin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-31852?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-31852 have an EU (EUVD) identifier?

Yes. CVE-2026-31852 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-11242.

When was CVE-2026-31852 published?

CVE-2026-31852 was published on 2026-03-11 and last updated on 2026-06-17.

CVE-2026-31852

CVE-2026-31852 is a critical-severity vulnerability in Jellyfin with a CVSS 3.x base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-269.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-11242
Weakness: CWE-269
Affected product: Jellyfin
Published: 2026-03-11
Last modified: 2026-06-17

Description

Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.

Frequently asked questions

What is CVE-2026-31852?: Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.
How severe is CVE-2026-31852?: CVE-2026-31852 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-31852 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-31852?: CVE-2026-31852 affects Jellyfin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-31852?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-31852 have an EU (EUVD) identifier?: Yes. CVE-2026-31852 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-11242.
When was CVE-2026-31852 published?: CVE-2026-31852 was published on 2026-03-11 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:jellyfin:jellyfin:-:*:*:*:*:*:*:*

More vulnerabilities in Jellyfin

CVE-2026-35031 — Critical (CVSS 9.9): Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the…
CVE-2026-35033 — Critical (CVSS 9.1): Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary…
CVE-2023-30627 — Critical (CVSS 9.0): jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to…
CVE-2025-31499 — High (CVSS 8.8): Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in…
CVE-2023-30626 — High (CVSS 8.8): Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory…
CVE-2022-35909 — High (CVSS 8.8): In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

All CVEs affecting Jellyfin →

Other CWE-269 (Improper Privilege Management) vulnerabilities

CVE-2025-20282 — Critical (CVSS 10.0): A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-0505 — Critical (CVSS 10.0): On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain…
CVE-2023-48418 — Critical (CVSS 10.0): In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW…
CVE-2023-48419 — Critical (CVSS 10.0): An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
CVE-2023-31273 — Critical (CVSS 10.0): Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to…
CVE-2022-1517 — Critical (CVSS 10.0): LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the…

Browse all CWE-269 (Improper Privilege Management) vulnerabilities →