Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

CVE-2026-49340

gonic is a music streaming server / Subsonic API implementation. Before v0.21.0, a logic error in ServeCreateOrUpdatePlaylist lets any authenticated Subsonic user, including non-admins, write playlist M3U content to an attacker-controlled absolute filesystem path on the host and create intermedia...

CVE-2026-49338

The CVE covers gonic, a Subsonic-compatible music server. Before 0.21.0, Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view allowed any authenticated user to delete or read any other user’s private playlist due to missing per-resource authorization. The playlist ID is bas...

CVE-2026-49338 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...

EUVD-2026-38062

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the first path segment of the attacker-controll...

PT-2026-51012

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.21.0 Description The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or re...

EUVD-2018-20876

Malware in sbrugna...

EUVD-2018-17777

Malware in sbrugna...

EUVD-2008-2386

Malware in sbrugna...

EUVD-2018-6582

Malware in sbrugna...

EUVD-2018-6584

Malware in sbrugna...

EUVD-2017-18348

Malware in sbrugna...

EUVD-2018-12794

Malware in sbrugna...

EUVD-2018-7754

Malware in sbrugna...

EUVD-2018-6585

Malware in sbrugna...

EUVD-2017-18350

Malware in sbrugna...

EUVD-2017-18349

Malware in sbrugna...

EUVD-2018-6583

Malware in sbrugna...

EUVD-2023-3317

Malicious code in bioql PyPI...

EUVD-2021-8696

Malicious code in bioql PyPI...