---
id: multi-user/a-plugin-s-settings-routes-are-reachable-by
title: "A plugin's settings routes are reachable by anyone the plugin is granted to"
theme: multi-user
status: open
created: 2026-08-21
date_source: stated
order: 1
---

**A plugin's settings routes are reachable by anyone the plugin is granted to.** Jellyfin's
`/_config` stores a server's admin token and drives provisioning, and a Member granted the plugin
can reach it. Agreed 2026-08-21 that the plugin should enforce this from facts the platform passes
(`isOwner` plus the effective level, never the role name), with a proposal to declare owner-only
path prefixes in the manifest so forgetting the check is not a silent hole. **Blocked on credential
resolution:** connections are per-user, so locking `/_config` today leaves a Member with a plugin
that only shows a connect form they may not submit. See `docs/plugin-route-authorization.md`.