CVE-2026-49338

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49338", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.902Z", "datePublished": "2026-06-19T19:08:34.220Z", "dateUpdated": "2026-06-23T02:21:47.053Z"}, "containers": {"cna": {"title": "Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"}, {"name": "https://github.com/sentriz/gonic/commit/6dd71e6", "tags": ["x_refsource_MISC"], "url": "https://github.com/sentriz/gonic/commit/6dd71e6"}], "affected": [{"vendor": "sentriz", "product": "gonic", "versions": [{"version": "< 0.21.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T19:08:34.220Z"}, "descriptions": [{"lang": "en", "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"<userID>/<filename>.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."}], "source": {"advisory": "GHSA-hmgp-w9jm-vp95", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T02:20:58.415088Z", "id": "CVE-2026-49338", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T02:21:47.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49338", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T02:20:58.415088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T02:21:40.823Z"}}], "cna": {"title": "Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)", "source": {"advisory": "GHSA-hmgp-w9jm-vp95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "sentriz", "product": "gonic", "versions": [{"status": "affected", "version": "< 0.21.0"}]}], "references": [{"url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95", "name": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sentriz/gonic/commit/6dd71e6", "name": "https://github.com/sentriz/gonic/commit/6dd71e6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"<userID>/<filename>.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T19:08:34.220Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49338", "state": "PUBLISHED", "dateUpdated": "2026-06-23T02:21:47.053Z", "dateReserved": "2026-05-29T14:35:45.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-19T19:08:34.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gonic", "vendor": "sentriz", "versions": [{"status": "affected", "version": "< 0.21.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"<userID>/<filename>.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0."}, {"lang": "es", "value": "gonic es un servidor de transmisi\u00f3n de m\u00fasica / implementaci\u00f3n de API de servidor subsonic de software libre. Antes de la versi\u00f3n 0.21.0, los endpoints de la API de Subsonic \u201c/rest/deletePlaylist.view\u201d y \u201c/rest/getPlaylist.view\u201d no realizan autorizaci\u00f3n por recurso. Una vez autenticado como cualquier usuario (administrador o no), un atacante puede eliminar cualquier lista de reproducci\u00f3n propiedad de cualquier otro usuario (incluido el administrador) pasando su \u2019id\u2019 y leer el contenido completo (nombre, comentario, lista de canciones) de la lista de reproducci\u00f3n privada (no p\u00fablica) de cualquier otro usuario pasando su \u2019id\u2019. El \u2019id\u2019 de la lista de reproducci\u00f3n de Subsonic es \u2019base64url(\u201c[userID]/[filename].m3u\u201d)\u2019. Debido a que los nombres de archivo son proporcionados por el usuario o derivados del tiempo y el \u2019userID\u2019 es un entero peque\u00f1o, los \u2019ID\u2019 son adivinables y frecuentemente expuestos (por ejemplo, una lista de reproducci\u00f3n previamente p\u00fablica que luego se hizo privada todav\u00eda tiene el mismo \u2019ID\u2019). Esto rompe el l\u00edmite de confianza multiusuario de gonic: un usuario con pocos privilegios puede borrar las listas de reproducci\u00f3n curadas de un administrador, y un usuario puede exfiltrar cualquier lista de reproducci\u00f3n privada para la que obtenga un \u2019ID\u2019. El problema se solucion\u00f3 en el commit \u20196dd71e6a3c966867ef8c900d359a7df75789f410\u2019, que forma parte de la versi\u00f3n 0.21.0."}], "id": "CVE-2026-49338", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49338", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T02:20:58.415088Z", "version": "2.0.3"}}]}, "published": "2026-06-19T19:16:36.557", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sentriz/gonic/commit/6dd71e6"}, {"source": "security-advisories@github.com", "url": "https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.21.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gonic", "source": "cna", "vendor": "sentriz"}, "product": "gonic", "vendor": "sentriz"}], "created": "2026-06-19T20:30:04.651795+00:00", "updated": "2026-06-20T22:34:37.372083+00:00", "vendors": ["sentriz", "sentriz$PRODUCT$gonic"]}