CVE-2026-31852 Details
Description
Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.
A vulnerability has been identified in the GitHub Actions workflow 'code-quality.yml' of the Jellyfin iOS repository. This issue allows for arbitrary code execution through pull requests from forked repositories. The vulnerability arises from the workflow's elevated permissions, which include nearly all write capabilities. Exploiting this flaw could lead to a complete takeover of the Jellyfin iOS repository, unauthorized access to highly privileged secrets such as the JF_BOT_TOKEN and App Store Connect API credentials, and the ability to push malicious updates to iOS apps via an Apple App Store supply chain attack. Additionally, it could result in GitHub Container Registry package poisoning and a full compromise of the Jellyfin organization through cross-repository token usage.
The CI workflows have been updated in all affected repositories, and the compromised secrets have been rotated.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jellyfin jellyfin | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |