CVE-2026-49339

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.

• CWE-22
• CWE-639

• https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445
• https://github.com/sentriz/gonic/commit/6dd71e6
• https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448
• https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448

Published

Jun 19, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4933Incorrect Authorization vulnerability in Drupal Unpublished …7.5
• CVE-2026-49331A flaw was found in openshift/oauth-proxy. On paths configur…6.5
• CVE-2026-49332A flaw was found in openshift/oauth-proxy. The proxy sets au…8.5
• CVE-2026-49336@microsoft/kiota-http-fetchlibrary provides TypeScript libra…5.5
• CVE-2026-49337libde265 is an open source implementation of the h.265 video…4.3
• CVE-2026-49338gonic is a music streaming server / free-software subsonic s…7.1
• CVE-2026-49340gonic is a music streaming server / free-software subsonic s…8.1
• CVE-2026-49342YARD is a documentation generation tool for the Ruby program…5.3
• CVE-2026-49343Klever-Go is the Go implementation of the Klever blockchain …5.9
• CVE-2026-49344Mercator is an open source web application that enables mapp…7.1
• CVE-2026-49345Mercator is an open source web application that enables mapp…5.3
• CVE-2026-49346libde265 is an open source implementation of the h.265 video…7.1