CVE-2025-48948: navidrome Incorrect Authorization

Vulnerability summary

CVE-2025-48948 is a high (CVSS 7.4) Incorrect Authorization vulnerability in navidrome. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-05-2025
   PublishedVulnerability first disclosed.
2. 30-05-2025
   Last modifiedVulnerability information updated.

Description

Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.