Executive brief
Gonic, a self-hosted music streaming server, contains a security flaw in its Subsonic API implementation. Any logged-in user can view or permanently delete playlists belonging to any other user, including administrators. This allows unauthorized access to private data and can lead to the loss of curated music collections.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the Subsonic API implementation of gonic. Specifically, the `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` endpoints in `server/ctrlsubsonic/handlers_playlist.go` do not verify if the requesting user owns the playlist or if the playlist is public before performing read or delete operations. An attacker requires a valid account (low privileges) and the target playlist ID, which is predictable as it is a base64-encoded string containing the owner's user ID and the filename. This allows for unauthorized data exfiltration of private playlists and unauthorized deletion of any playlist. The issue is fixed in commit 6dd71e6 and version 0.21.0.
Affected products
- sentriz gonic <= 0.20.1
Timeline
- 2026-05-18: patched: Fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410
- 2026-06-19: kev added: NVD publication date
- 2026-06-26: advisory: GitHub Advisory published