CVE-2026-129131 | Gameyfin up to 2.6.1 Hilla endpoint GameEndpoint.sync improper authorization

November 13, 2026 Yanac

A vulnerability identified as problematic has been detected in Gameyfin up to 2.6.1. This vulnerability affects the function GameEndpoint.sync of the component Hilla endpoint. Performing a manipulation results in improper authorization.

This vulnerability is reported as CVE-2026-129131. The attack is possible to be carried out remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More