CVE-2026-49338: Gonic Authorization Bypass Allows Playlist Deletion and Private Content Access

Technical summary

The vulnerability resides in the Subsonic API endpoint implementations `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` in gonic versions prior to 0.21.0. These endpoints perform user authentication but lack per-resource authorization checks, allowing any authenticated user to perform operations on playlists owned by other users. Playlist IDs are generated as base64url-encoded strings combining a numeric user ID and a playlist filename. Because user IDs are small integers and filenames are either user-supplied or time-derived, the ID space is sufficiently guessable. Previously-public playlists retain the same ID when made private, creating an attack vector for ID discovery. The fix (commit 6dd71e6a3c966867ef8c900d359a7df75789f410) implements proper ownership validation before allowing playlist access or deletion.

Business impact

For organizations or communities running gonic instances with multiple users, this vulnerability enables account-to-account attacks within the same system. Administrators lose the ability to protect curated playlists from deletion by lower-privileged users. Content creators or users storing private playlists risk unauthorized access and information disclosure. The breach of multi-user trust boundaries can erode confidence in the platform's security posture, particularly in collaborative or shared music library deployments. Downtime or data loss from malicious playlist deletion may disrupt service availability.

Affected systems

All deployments of gonic prior to version 0.21.0 are affected. The vulnerability is present regardless of operating system or deployment method, as it is a logic flaw in the core API implementation. Any instance exposed to multiple user accounts is at risk. Standalone single-user installations are not vulnerable in a practical sense, as there are no other users to target.

Exploitability

Exploitation requires valid login credentials (any user account), making it an authenticated attack. However, the barrier to entry is low: attackers need only gain access to a single low-privileged account or use leaked credentials. No special tools or complex interaction are required; standard HTTP requests to the affected endpoints with guessed or known playlist IDs suffice. The predictability of playlist IDs significantly reduces the effort needed to identify targets. The CVSS score of 7.1 reflects the combination of required authentication, network accessibility, and high integrity impact balanced against limited confidentiality impact.

Remediation

Upgrade gonic to version 0.21.0 or later. The fix enforces per-resource authorization checks ensuring that only the playlist owner or an administrator can access or delete a given playlist. No configuration changes or workarounds are available for earlier versions; patching is the only remediation.

Patch guidance

Apply the update to gonic version 0.21.0 immediately. Verify the update against the official gonic repository and release notes. If running gonic in a containerized environment, pull the updated image. If building from source, ensure commit 6dd71e6a3c966867ef8c900d359a7df75789f410 or later is included. After patching, restart the gonic service and validate that authorization checks are enforced by attempting to access or delete a playlist owned by a different user—the operation should be rejected.

Detection guidance

Monitor HTTP logs for repeated or suspicious requests to `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` endpoints from a single user account, particularly requests targeting playlist IDs that do not match the requesting user's ID pattern. Examine gonic access logs for delete operations on playlists across multiple user ID boundaries. If the application logs resource ownership information, correlate deletion events with user IDs to identify cross-user deletion attempts. Review audit logs for unexpected playlist deletions if they are recorded. After patching, these operations should be denied and may appear as HTTP 403 (Forbidden) responses.

Why prioritize this

This vulnerability directly impacts multi-user security and data integrity. The combination of predictable IDs, low exploitation complexity, and high integrity impact (ability to delete any playlist) makes it a priority for any gonic deployment with multiple user accounts. The fact that even administrators are vulnerable to attack by low-privileged users elevates the risk to governance and operational continuity.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), and no user interaction needed (UI:N). The scope is unchanged (single trust boundary affected, though authorization is broken within it). Confidentiality impact is low (C:L) because exfiltration requires guessing valid playlist IDs; integrity impact is high (I:H) due to unrestricted playlist deletion by any authenticated user. Availability is not directly impacted (A:N), though deletion of playlists could disrupt service utility.

Frequently asked questions