Server Version#: 1.43.3
Player Version#: Plex Android TV app: 10.30.8.4222
I have found an issue where Plex Home user permissions are not being respected in the Android TV client.
I have two Plex servers. One server is only shared with the admin Home user, while two other Home users have no access to that server.
If the Android TV app is reset and I initially enter one of the restricted Home users, the permissions work correctly and the restricted user cannot see the server.
However, if I switch to the admin Home user, configure the home screen/sidebar, and then switch back to a restricted Home user, the restricted user gains access to the server they should not have access to.
The restricted users can:
- See the unavailable server under the “More” section of the sidebar.
- Add libraries from that server to their sidebar/home screen.
- Search and find content from that server.
- Play media from that server.
This behaviour only occurs in the Android TV client. The same Home users and permissions work correctly in Plex Web and the mobile app.
The issue appears to be related to Android TV not isolating Home user permissions/state after switching between users, allowing the admin user’s server access to leak into restricted Home user sessions.
In your server settings, do you have anything in the input field labeled “List of IP addresses and networks that are allowed without auth”?
If you do, verify that the Android TV is not inside the range of IP addresses defined.
Because it disables any kind of user-based access restriction.
I found the cause. Both servers had 192.168.0.0/16 configured under Settings → Network → List of IP addresses and networks that are allowed without auth (via the Docker ALLOWED_NETWORKS environment variable).
Thank you for the hint. Removing the allowed network immediately fixed the issue.
What is unexpected is that this setting only affects the Android TV client. Plex Web and the mobile app continue to enforce Home user permissions correctly even when the allowed network is configured.
Thank you for the help
Instead of whole networks, you might want to add single IP addresses of clients which are usually not used by restricted accounts. That way you are prepared for Internet outages, during which fresh sign-ins and user switching is not possible.
I understand your work around but having to do so is poor design. If you want access when there is no Internet you have to allow everyone to go around authentication. Otherwise you can pick and choose which clients get access when offline and then have to manage reserved IPs. Clearly Android TV is using a different auth path than browser and mobile (Android) that is problematic. We are being asked to choose between security and functionality.
Again, thank you for your help and time.
