Jellyfin 12.0 Upgrade Can Break on Name Collisions
Jellyfin 12.0 shipped with security fixes and breaking changes for media-server admins. Help Net Security says the release blocks requests that try to reach files outside served directories, rejects unsafe plugin packages, drops legacy client logins, and changes first-run setup and the web interface.
The upgrade trap is the first-boot database migration. Jellyfin rewrites its database when 12.0 starts, and case-insensitive usernames now collide, so two accounts that differ only by capitalization can make the migration fail outright. That means the server may not come back cleanly, and old clients or third-party plugins can stop working at the same time.
For operators with custom plugins, long-lived accounts, or old clients, the lasting exposure is upgrade choreography rather than exploitation. Once the migration starts, rollback depends on having a usable backup, so the practical risk sits at service availability and user access if the database state is not ready for 12.0.