PT-2025-23229 · Navidrome+1 · Navidrome+1
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Navidrome versions prior to 0.56.0
Description
A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. The vulnerability exists in the API endpoints that manage transcoding settings, such as
POST /api/transcoding, PUT /api/transcoding/:id, DELETE /api/transcoding/:id, and GET /api/transcoding. The application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests, despite the JWT token clearly indicating the user is not an administrator ("adm":false).Recommendations
For Navidrome versions prior to 0.56.0, update to version 0.56.0 to patch the issue. As a temporary workaround, consider disabling the transcoding functionality to minimize the risk of exploitation. Restrict access to the vulnerable API endpoints to minimize the risk of unauthorized configuration changes. Avoid using the
POST /api/transcoding, PUT /api/transcoding/:id, DELETE /api/transcoding/:id, and GET /api/transcoding endpoints with regular user credentials until the issue is resolved.Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Navidrome