CVE-2026-49339 Details
Description
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.
A vulnerability in Gonic, a music streaming server implementing the Subsonic API, allows authenticated users to bypass playlist ownership checks. This issue is present in versions through 0.20.1. The vulnerability arises because the ownership check relies on `playlist.UserID`, which is derived from the first segment of the user-controlled playlist ID. This ID can be manipulated to access or delete other users' playlists, including those of admins. Additionally, the vulnerability allows probing of arbitrary file paths on the host for existence and readability.
Users can update to Gonic version 0.21.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448 | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445 | [email protected] | Source CodeVendor |
| https://github.com/sentriz/gonic/commit/6dd71e6 | [email protected] | Source CodeVendor |
| https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gonic | <= 0.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |