CVE-2026-49338

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.21.0

Description The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or read the full contents (name, comment, and song list) of any private playlist belonging to another user, including administrators, by providing the playlist id. The playlist id is generated using base64url("<userID>/<filename>.m3u"). Since userID is a small integer and filenames are either user-supplied or time-derived, these IDs are guessable or may have been previously exposed, allowing low-privileged users to delete administrator playlists or exfiltrate private data.

Recommendations Update to version 0.21.0 or later.