CVE-2022-35909

An attacker with any authenticated user account can send a POST request to `/Repositories` with a crafted JSON body containing a list of repository definitions. Because the endpoint previously used the `DefaultAuthorization` policy [patch_id=1641439], it did not check for elevated (admin) privileges. This allows a low-privilege user to add, remove, or modify package repository URLs, potentially pointing the server to a malicious repository that serves compromised plugins.

The vulnerability resides in the `Jellyfin.Api/Controllers/PackageController.cs` file. The `SetRepositories` endpoint (`POST /Repositories`) was protected only by the `DefaultAuthorization` policy, which does not require administrative privileges. The patch changes the authorization policy on this endpoint to `RequiresElevation`, ensuring only admin users can modify repository settings.

The fix changes the `[Authorize]` attribute on the `SetRepositories` method from `Policies.DefaultAuthorization` to `Policies.RequiresElevation` [patch_id=1641439]. This ensures that only users with administrative privileges can modify the list of package repositories. The `DefaultAuthorization` policy only requires any authenticated session, while `RequiresElevation` enforces an admin-level check, closing the privilege escalation gap.