EUVD-2026-38067
GHSA-hmgp-w9jm-vp95
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-reachable Subsonic API, any authenticated user suffices (PR:L), no UI; reading private playlist metadata is limited confidentiality (C:L), deleting admin playlists is high integrity (I:H), service stays up (A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its id and read the full contents (name, comment, song list) of any other user's private (non-public) playlist by passing its id. The Subsonic playlist id is base64url("<userID>/<filename>.m3u"). Because filenames are user-supplied or time-derived and the userID is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410, which is part of version 0.21.0.
AnalysisAI
Broken authorization in gonic music streaming server prior to version 0.21.0 allows any authenticated user to delete or read other users' playlists via the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view. Because playlist IDs are base64url-encoded paths containing a small integer user ID and a guessable filename, low-privileged users can enumerate IDs to wipe an administrator's curated playlists or exfiltrate the contents of any private playlist. No public exploit identified at time of analysis, and the issue is patched in commit 6dd71e6 included in version 0.21.0.
Technical ContextAI
gonic is a self-hosted, free-software implementation of the Subsonic music-server API written in Go (CPE cpe:2.3:a:sentriz:gonic). The vulnerable handlers ServeGetPlaylist and ServeDeletePlaylist in server/ctrlsubsonic/handlers_playlist.go authenticated the caller but never checked whether the caller actually owned the requested playlist or whether the playlist was marked public, a textbook CWE-285 Improper Authorization (missing object-level access control). Playlist resources are addressed by an opaque-looking ID that is in fact base64url("<userID>/<filename>.m3u"), where userID is a small monotonically increasing integer and the filename is either user-supplied or derived from a timestamp, so the identifier space is small and frequently leaks (e.g., a playlist that was once public keeps the same ID after being made private). The fix adds explicit ownership and IsPublic checks in both handlers, returning Subsonic error 50 when a caller targets another user's resource.
RemediationAI
Vendor-released patch: gonic 0.21.0 - upgrade to 0.21.0 or later, which includes commit 6dd71e6 adding per-resource ownership and IsPublic checks to ServeGetPlaylist and ServeDeletePlaylist (https://github.com/sentriz/gonic/commit/6dd71e6, advisory https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95). If upgrading immediately is not possible, restrict the gonic instance to a single trusted user or place the Subsonic API behind a reverse proxy that limits /rest/getPlaylist.view and /rest/deletePlaylist.view to known-good accounts, accepting that this disables multi-user functionality. Operators should also audit on-disk playlist files for unexpected deletions and consider rotating playlist filenames after upgrade, since previously-disclosed IDs from public-then-private playlists remain guessable until renamed.
Arbitrary file write in gonic music streaming server prior to v0.21.0 allows any authenticated Subsonic user - including
Authenticated path traversal in gonic music streaming server allows any Subsonic user to read or delete other users' pla
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today