CVE-2025-48948

Name of the Vulnerable Software and Affected Versions Navidrome versions prior to 0.56.0

Description A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. The vulnerability exists in the API endpoints that manage transcoding settings, such as POST /api/transcoding, PUT /api/transcoding/:id, DELETE /api/transcoding/:id, and GET /api/transcoding. The application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests, despite the JWT token clearly indicating the user is not an administrator ("adm":false).

Recommendations For Navidrome versions prior to 0.56.0, update to version 0.56.0 to patch the issue. As a temporary workaround, consider disabling the transcoding functionality to minimize the risk of exploitation. Restrict access to the vulnerable API endpoints to minimize the risk of unauthorized configuration changes. Avoid using the POST /api/transcoding, PUT /api/transcoding/:id, DELETE /api/transcoding/:id, and GET /api/transcoding endpoints with regular user credentials until the issue is resolved.