CVE-2026-49339
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk17th percentile — higher than 17% of all known CVEs
Summary
Gonic, a music streaming server, has a vulnerability that allows authenticated Subsonic users to bypass playlist ownership checks. Users can read and delete other users' playlists and probe arbitrary file paths on the server.
Risk Assessment
This vulnerability poses a significant risk to user data privacy and the integrity of their playlists, potentially leading to unauthorized access to sensitive information.
Recommendation
It is recommended to upgrade to version 0.21.0, which includes a fix for this issue. Additionally, an access audit of playlists should be conducted to minimize risk.
Original NVD description (English source)
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.