Finder

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

This issue may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination, allowing logging in without a password or viewing a list of user accounts that may have no password configured. Impacted are all Emby Server systems that are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users.