CVE-2026-49338: gonic Auth Bypass Vulnerability

CVE-2026-49338 Overview

CVE-2026-49338 is a missing authorization vulnerability [CWE-285] in gonic, a free-software music streaming server that implements the Subsonic API. Versions prior to 0.21.0 fail to enforce per-resource authorization on the /rest/deletePlaylist.view and /rest/getPlaylist.view endpoints. Any authenticated user can delete or read playlists owned by other users, including administrators. Playlist IDs follow the predictable format base64url("<userID>/<filename>.m3u"), making them guessable across the multi-user trust boundary. The issue is fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410, included in version 0.21.0.

Critical Impact
A low-privileged authenticated user can wipe an administrator's curated playlists and exfiltrate the contents of any private playlist whose ID can be guessed or obtained.

Affected Products

gonic music streaming server versions prior to 0.21.0
Subsonic API endpoint /rest/deletePlaylist.view
Subsonic API endpoint /rest/getPlaylist.view

Discovery Timeline

2026-06-19 - CVE-2026-49338 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49338

Vulnerability Analysis

The vulnerability affects two Subsonic API handlers in gonic. Both ServeGetPlaylist and ServeDeletePlaylist accept a playlist id parameter and act on the referenced playlist without verifying that the caller owns the resource. Authentication is required, but authorization checks against the playlist owner are absent.

A Subsonic playlist id in gonic is constructed as base64url("<userID>/<filename>.m3u"). The userID field is a small integer assigned sequentially. The filename is either user-supplied or time-derived. Both properties make IDs guessable, and previously public playlists that are later made private retain the same ID. This allows an attacker to enumerate or recover identifiers and target arbitrary playlists.

Root Cause

The handlers resolved the playlist by ID and performed the requested read or delete operation without comparing the playlist owner to the authenticated user context. The fix retrieves the current user from the request context and enforces ownership before acting on the resource.

Attack Vector

Exploitation requires only valid Subsonic API credentials for any account on the target gonic instance. The attacker sends a crafted request to /rest/getPlaylist.view or /rest/deletePlaylist.view with a guessed or known playlist id. The server returns the full playlist contents — including name, comment, and song list — or deletes the playlist outright.

// Patch excerpt: enforce playlist ownership on getPlaylist/deletePlaylist
// File: server/ctrlsubsonic/handlers_playlist.go
func (c *Controller) ServeGetPlaylist(r *http.Request) *spec.Response {
    user := r.Context().Value(CtxUser).(*db.User)
    params := r.Context().Value(CtxParams).(params.Params)
    playlistID, err := params.GetFirstID("id", "playlistId")
    if err != nil {
        // ...
    }
    // subsequent logic now compares playlist owner against user
}
// Source: https://github.com/sentriz/gonic/commit/6dd71e6

The patch introduces the user := r.Context().Value(CtxUser).(*db.User) lookup, which the handler then uses to reject requests where the playlist owner differs from the authenticated principal.

Detection Methods for CVE-2026-49338

Indicators of Compromise

Subsonic API requests to /rest/getPlaylist.view or /rest/deletePlaylist.view where the id parameter decodes to a userID that does not match the authenticated account.
Unexpected playlist deletions reported by administrators or other users.
HTTP access logs showing playlist ID enumeration patterns from a single client.

Detection Strategies

Decode base64url playlist IDs in access logs and compare the embedded userID against the authenticated session user.
Alert on bursts of requests to /rest/deletePlaylist.view from a single non-admin account.
Audit the gonic database for sudden drops in playlist counts per user.

Monitoring Recommendations

Forward gonic HTTP access logs to a central log platform with retention sufficient for incident review.
Track playlist create and delete events against application state to detect tampering.
Monitor for sequential or scripted id parameter values indicating enumeration.

How to Mitigate CVE-2026-49338

Immediate Actions Required

Upgrade gonic to version 0.21.0 or later, which includes commit 6dd71e6a3c966867ef8c900d359a7df75789f410.
Audit existing playlists and back up .m3u files before upgrading so accidental losses can be restored.
Review user accounts and rotate Subsonic API credentials for any account suspected of misuse.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-hmgp-w9jm-vp95 and applied in the upstream commit 6dd71e6. The handlers now resolve the authenticated user from the request context and reject operations on playlists owned by other accounts.

Workarounds

Restrict gonic to trusted users only until the upgrade is applied, since any authenticated account can exploit the issue.
Place the gonic instance behind a reverse proxy that limits request rates to playlist endpoints to slow ID enumeration.
Remove or disable non-essential user accounts that do not require playlist access.

bash

# Upgrade gonic to a fixed release (example using Docker)
docker pull sentriz/gonic:0.21.0
docker stop gonic && docker rm gonic
docker run -d --name gonic \
  -v /path/to/data:/data \
  -v /path/to/music:/music:ro \
  -p 4747:80 \
  sentriz/gonic:0.21.0