VulnSocial

CVE-2026-49338Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full contents (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url("<userID>/<filename>.m3u")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. The issue was fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`, which is part of version 0.21.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-06-20)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-19: 1Mentions · 2026-06-20: 2Patch / Workaround · 2026-06-20: 1Technical Details · 2026-06-19: 1Technical Details · 2026-06-20: 106-1906-20
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-191
Disclosure1
2026-06-202
Disclosure1General1
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-49338 gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` … https://www.cve.org/CVERecord?id=CVE-2026-49338 ----- Traducción: CVE-2026-49338 gon… http://infoflow.cloud`

    Post summary

    The message merely cites CVE‑2026‑49338 for a Subsonic API endpoint, noting that versions before 0.21.0 are affected, but offers no further technical or exploit information.

    0000043
    88 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-49338 gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` … https://www.cve.org/CVERecord?id=CVE-2026-49338

    Post summary

    The passage announces CVE‑2026‑49338, noting the affected Subsonic API endpoint and version, but provides no PoC, exploit, or patch information.

    00000208
    57.7K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49338 Unauthorized Playlist Access and Deletion in Gonic Prior to Version 0.21.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49338

    Post summary

    The entry announces CVE‑2026‑49338, which permits unauthorized access and deletion of playlists in Gonic versions earlier than 0.21.0, but it provides no proof of concept, exploit code, or patch information.

    0000038
    4.1K followersView on X

Explore more

Back to dashboard