Is CVE-2026-49338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49338 being exploited in the wild.

How severe is CVE-2026-49338?

High severity, with a CVSS score of 7.1, published 19 June 2026.

Which products and versions are affected?

go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.

Is there a fix for CVE-2026-49338?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49338 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49338?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49338: sentriz gonic improper authorization in Subsonic API playlists

Q: Is there a fix for CVE-2026-49338?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49338 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49338?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49338 · Severity: high · CVSS 7.1 · Published 2026-06-19

Gonic, a self-hosted music streaming server, contains a security flaw in its Subsonic API implementation. Any logged-in user can view or permanently delete playlists belonging to any other user, including administrators. This allows unauthorized access to private data and can lead to the loss of curated music collections.

Technologies: go.senan.xyz/gonic (Go), Sentriz Gonic. Vendors: Go, Sentriz.

Quick answers

Is CVE-2026-49338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49338 being exploited in the wild.
How severe is CVE-2026-49338?: High severity, with a CVSS score of 7.1, published 19 June 2026.
Which products and versions are affected?: go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.
Is there a fix for CVE-2026-49338?: Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49338 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49338?: Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later
```
go get go.senan.xyz/gonic@v0.21.0
```

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the Subsonic API implementation of gonic. Specifically, the `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` endpoints in `server/ctrlsubsonic/handlers_playlist.go` do not verify if the requesting user owns the playlist or if the playlist is public before performing read or delete operations. An attacker requires a valid account (low privileges) and the target playlist ID, which is predictable as it is a base64-encoded string containing the owner's user ID and the filename. This allows for unauthorized data exfiltration of private playlists and unauthorized deletion of any playlist. The issue is fixed in commit 6dd71e6 and version 0.21.0.

Affected products

sentriz gonic <= 0.20.1

Identifiers

CVE-2026-49338
GHSA-hmgp-w9jm-vp95
GO-2026-5830

Timeline

2026-05-18: patched: Fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410
2026-06-19: kev added: NVD publication date
2026-06-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.