{"id":"EUVD-2026-38067","enisaUuid":"c16ec8fd-c40c-3128-9a5b-a9bfd321f93a","description":"gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0.","datePublished":"Jun 19, 2026, 7:08:34 PM","dateUpdated":"Jun 23, 2026, 2:21:47 AM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95\nhttps://github.com/sentriz/gonic/commit/6dd71e6\n","aliases":"CVE-2026-49338\nGHSA-hmgp-w9jm-vp95\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"ac9ce420-da16-36bb-87a8-66d6d2acf59e","product":{"name":"gonic","vendor":{"name":"sentriz"}},"product_version":"\u003c 0.21.0"}],"enisaIdVendor":[{"id":"16b53e36-2b5b-36d2-a52f-60d27b7bab87","vendor":{"name":"sentriz"}}],"enisaIdVulnerability":[{"id":"a758dba4-feb7-309e-9f56-871e6a8d6b9a","vulnerability":{"id":"GHSA-hmgp-w9jm-vp95","description":"Subsonic API: any authenticated user can delete or read any other user\u0027s playlist (IDOR)","datePublished":"Jun 26, 2026, 11:33:24 PM","dateUpdated":"Jun 26, 2026, 11:33:25 PM","baseScore":0.0,"references":"https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49338\nhttps://github.com/sentriz/gonic/commit/6dd71e6\nhttps://github.com/sentriz/gonic\n","enisa_id":"EUVD-2026-38067\n","aliases":"CVE-2026-49338\nGHSA-hmgp-w9jm-vp95\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ddae9572-6dd0-3a9a-8ef6-88737c95214f","vulnerability":{"id":"CVE-2026-49338","description":"gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user\u0027s **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url(\"\u003cuserID\u003e/\u003cfilename\u003e.m3u\")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator\u0027s curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0.","datePublished":"Jun 19, 2026, 7:08:34 PM","dateUpdated":"Jun 23, 2026, 2:21:47 AM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95\nhttps://github.com/sentriz/gonic/commit/6dd71e6\n","enisa_id":"EUVD-2026-38067\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 7, 2026, 7:22:41 AM","vulnerabilityProduct":[{"id":"05b0a629-3fa4-3991-8961-e33e695cfcfb","product":{"name":"gonic","vendor":{"name":"sentriz"}},"product_version":"\u003c 0.21.0"}],"vulnerabilityVendor":[{"id":"c638747e-ba49-3b3b-ad04-3c146d552c77","vendor":{"name":"sentriz"}}]}}],"enisaIdAdvisory":[]}