Authorization Bypass Vulnerability in Navidrome Music Server
CVE-2025-48948

7.4HIGH

Key Information:

Vendor

Navidrome

Status
Navidrome
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48948?

A significant security flaw exists in Navidrome, an open-source web-based music collection server. This vulnerability allows authenticated regular users to bypass permission checks and perform sensitive actions typically reserved for administrators. Specifically, these users can modify transcoding settings, creating risks in scenarios where administrators are assumed to be trusted, but regular users are not. The issue is addressed in Navidrome version 0.56.0, making it crucial for users to upgrade to this version or later to ensure security.

Affected Version(s)

navidrome < 0.56.0

References

https://github.com/navidrome/navidrome/security/advisorie...
x_refsource_CONFIRM
https://github.com/navidrome/navidrome/pull/4096
x_refsource_MISC
https://github.com/navidrome/navidrome/commit/e5438552c63...
x_refsource_MISC

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48948 : Authorization Bypass Vulnerability in Navidrome Music Server