CVE-2026-49338

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url("<userID>/<filename>.m3u")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0.

• CWE-285
• CWE-639

• https://github.com/sentriz/gonic/commit/6dd71e6
• https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95

Published

Jun 19, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49328Server-Side Request Forgery (SSRF) in the UrlImageConverter …5.3
• CVE-2026-4933Incorrect Authorization vulnerability in Drupal Unpublished …7.5
• CVE-2026-49331A flaw was found in openshift/oauth-proxy. On paths configur…6.5
• CVE-2026-49332A flaw was found in openshift/oauth-proxy. The proxy sets au…8.5
• CVE-2026-49336@microsoft/kiota-http-fetchlibrary provides TypeScript libra…5.5
• CVE-2026-49337libde265 is an open source implementation of the h.265 video…4.3
• CVE-2026-49339gonic is a music streaming server / free-software subsonic s…7.1
• CVE-2026-49340gonic is a music streaming server / free-software subsonic s…8.1
• CVE-2026-49342YARD is a documentation generation tool for the Ruby program…5.3
• CVE-2026-49343Klever-Go is the Go implementation of the Klever blockchain …5.9
• CVE-2026-49344Mercator is an open source web application that enables mapp…7.1
• CVE-2026-49345Mercator is an open source web application that enables mapp…5.3