Users accessing files from libraries they don't have access to

[ryderjj89 33]

Logged into my Dashboard this morning, looked at the logs that show on the right for recent activity and noticed that one of my users was playing a music file.

The problem: None of my users have access to my music library except me, yet their Emby for Android would just start playing music from my server when they'd hit the play button on their headset.

Nothing in the logs indicates anything weird, just stays that Emby for Android started playing <song title>. I'm not sure how this could happen or what to even do to stop it in the future, except maybe hope the next version already has some kind of fix for this. I confirmed multiple times that they don't have access to that library AND when they pull Emby up, they can't see the library either. This person isn't close to me so I'm not sure if it's some DLNA thing, which I don't think so but I've went ahead and disabled that anyway since that feature isn't really used.

Anyone have any thoughts on why this might have happened or how to stop it?

[Luke 42080]

Hi, what versions of both the app and server?

[ryderjj89 33]

27 minutes ago, Luke said:

Hi, what versions of both the app and server?

Emby Server: 4.6.7.0

Emby for Android: 3.2.32

[Luke 42080]

OK I'm trying to think of how this could be possible. Do you know anything about how they use it? I doubt they got to it from the main UI but maybe there's a hole in our android auto or google assistant features.

[ryderjj89 33]

3 minutes ago, Luke said:

OK I'm trying to think of how this could be possible. Do you know anything about how they use it? I doubt they got to it from the main UI but maybe there's a hole in our android auto or google assistant features.

So that's what's really puzzling. He can't see my music when he goes into Emby and looks at the libraries. I also confirmed in his profile that he doesn't have access. But, I'm guessing something with his headset is auto starting Emby when he presses the play button to play music and it's somehow bypassing the fact he doesn't have access because he was definitely playing a song I have. It was actually making him think he was getting hacked because it was music that he doesn't like at all.

Edited March 10, 2022 by ryderjj89

[ryderjj89 33]

Any info on this @Luke? Or did you need more information from me?

[Luke 42080]

We're looking into it. Thanks.