Insecure Direct Object Reference in Gonic Music Streaming Server by Sentriz

CVE-2026-49339

What is CVE-2026-49339?

Gonic, a free-software subsonic server API implementation, has a vulnerability that permits authenticated users to bypass ownership checks on playlists due to flawed path handling in the playlist ID. This flaw allows unauthorized access to manipulate and delete playlists belonging to other users, as well as probe for arbitrary files on the server. The issue arises from how playlist.UserID is extracted from the first path segment of the attacker-controlled playlist ID, as the implemented checks do not sufficiently validate the resolved file paths. The vulnerability has been addressed in version 0.21.0.

References