CVE-2025-48948: Navidrome Auth Bypass Vulnerability

CVE-2025-48948 Overview

Navidrome, an open source web-based music collection server and streamer, contains a broken access control flaw in versions prior to 0.56.0. Any authenticated regular user can bypass authorization checks and perform administrator-only transcoding configuration operations. Attackers can create, modify, and delete transcoding settings without administrative privileges. The vulnerability falls under [CWE-863: Incorrect Authorization]. Version 0.56.0 remediates the issue by enforcing administrator role checks on transcoding operations.

Critical Impact
Authenticated low-privileged users can alter server-wide transcoding configuration, undermining the trust boundary between regular users and administrators when transcoding is enabled.

Affected Products

Navidrome versions prior to 0.56.0
Deployments with transcoding enabled
All platforms hosting affected Navidrome builds

Discovery Timeline

2025-05-30 - CVE CVE-2025-48948 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48948

Vulnerability Analysis

The vulnerability resides in Navidrome's transcoding repository layer. Methods that create, update, or delete transcoding configuration did not verify whether the calling user held administrator privileges. The application relied on frontend controls and route-level assumptions instead of enforcing role checks in the persistence layer. Authenticated regular users could issue direct API requests to transcoding endpoints and modify server-wide settings.

Since transcoding configuration controls external command execution parameters used by the server, unrestricted write access to these settings represents a significant privilege boundary violation in the documented threat model where administrators are trusted but regular users are not.

Root Cause

The root cause is a missing authorization check inside transcoding_repository.go. Write operations such as Put executed persistence logic without verifying the caller's role. The fix introduces an isAdmin helper in sql_base_repository.go and invokes it before allowing mutations, returning rest.ErrPermissionDenied for non-admin callers.

Attack Vector

An attacker with any valid Navidrome user account authenticates to the server over the network and issues API requests targeting transcoding management endpoints. No user interaction and no elevated privileges are required beyond a standard authenticated session.

// Security patch in persistence/sql_base_repository.go
// fix(transcoding): restrict transcoding operations to admin users (#4096)

+func isAdmin(ctx context.Context) bool {
+	user := loggedUser(ctx)
+	return user.IsAdmin
+}
+
 func (r *sqlRepository) registerModel(instance any, filters map[string]filterFunc) {
 	if r.tableName == "" {
 		r.tableName = strings.TrimPrefix(reflect.TypeOf(instance).String(), "*model.")

Source: GitHub Commit e5438552

// Security patch in persistence/transcoding_repository.go
// Enforces admin-only access on Put operations

 func (r *transcodingRepository) Put(t *model.Transcoding) error {
+	if !isAdmin(r.ctx) {
+		return rest.ErrPermissionDenied
+	}
 	_, err := r.put(t.ID, t)
 	return err
 }

Source: GitHub Commit e5438552

Detection Methods for CVE-2025-48948

Indicators of Compromise

Unexpected creation, modification, or deletion of transcoding profiles by non-administrator accounts.
HTTP requests to Navidrome transcoding REST endpoints originating from user sessions that do not hold the admin role.
Sudden appearance of new transcoding configurations referencing unusual external command paths or parameters.

Detection Strategies

Audit Navidrome access logs for POST, PUT, and DELETE requests against transcoding API paths, correlating each with the authenticated user's role.
Compare current transcoding configuration state against a known-good baseline to identify unauthorized changes.
Deploy web application firewall rules that restrict transcoding endpoints to authenticated sessions tied to administrator accounts.

Monitoring Recommendations

Enable verbose request logging on the Navidrome instance and forward logs to a centralized SIEM for role-based access analysis.
Alert on any transcoding configuration change events, especially outside normal administrator activity windows.
Monitor process execution on the Navidrome host for unexpected transcoder child processes spawned with modified arguments.

How to Mitigate CVE-2025-48948

Immediate Actions Required

Upgrade Navidrome to version 0.56.0 or later without delay.
Review current transcoding configuration and revert any unauthorized changes.
Rotate credentials for any user account suspected of exploiting the flaw.

Patch Information

The fix is delivered in Navidrome 0.56.0 via GitHub Pull Request #4096 and commit e5438552c63fecb6284e1b179dddae91ede869c8. Full remediation details are published in the GitHub Security Advisory GHSA-f238-rggp-82m3.

Workarounds

Disable transcoding functionality on the server until the upgrade to 0.56.0 is complete.
Restrict Navidrome network exposure to trusted networks or place the service behind an authenticating reverse proxy that limits transcoding endpoints to administrators.
Reduce the number of non-admin accounts and audit existing user roles until patching is complete.

bash

# Upgrade Navidrome using Docker
docker pull deluan/navidrome:0.56.0
docker stop navidrome && docker rm navidrome
docker run -d --name navidrome \
  -v /path/to/data:/data \
  -v /path/to/music:/music:ro \
  -p 4533:4533 \
  deluan/navidrome:0.56.0

# Verify installed version
curl -s http://localhost:4533/api/version