In Jellyfin prior to 10.8, the /users endpoint has incorrect access control for admin functionality.
jellyfin jellyfin