CVE-2026-31852

The vulnerability results from improper permission management (CWE-269) in the CI/CD workflow: code-quality.yml has broadly granted write permissions to the repository. An attacker can send a pull request from a forked repository whose code will be executed in the context of a privileged workflow. This enables access to organization secrets, modification of repository content, and injection of malicious code into packages published in GitHub Container Registry (ghcr.io) and distribution on the Apple App Store.

An attacker can gain full control over the jellyfin/jellyfin-ios repository, steal highly privileged secrets, infect container packages and compromise the entire Jellyfin organization through multiple use of tokens across repositories, constituting a supply chain attack.

The vulnerability only affects GitHub Actions workflow, not application code — end users do not need to take any action. The fix was introduced by the project creators in commit 109217e75f38394b2f6e46e25dfe5a721203d3c8 in the jellyfin/jellyfin-ios repository. Administrators of similar projects should verify the permissions of their own CI/CD workflows and restrict code execution from pull requests of external forks.

Repository jellyfin/jellyfin-ios — GitHub Actions workflow code-quality.yml; affects the project's CI/CD infrastructure, not the end software installed by users.