CVE-2022-35909

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-35917.8Use After Free in GitHub repository vim/vim prior to 9.0.0789.CVE-2022-359105.4In Jellyfin before 10.8, stored XSS allows theft of an admin access token.CVE-2022-359117.5On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. NOTE: the vendor'CVE-2022-359129.8In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 confCVE-2022-359134.3Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym.CVE-2022-359149.8/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.CVE-2022-359155.3OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cCVE-2022-359165.3OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossCVE-2022-359175.3Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps aCVE-2022-359186.5Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulCVE-2022-359192.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users autCVE-2022-35926.5A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured sh
CVE-2022-35909: High severity, CVSS 8.8 | Vulnix