CVE-2025-48948

Katalog CVE

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan Incorrect Authorization pada navidrome. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.

Rincian

Terbit di NVD

30 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3 exploit · advisory vendor
• https://github.com/navidrome/navidrome/commit/e5438552c63fecb6284e1b179dddae91ede869c8 patch
• https://github.com/navidrome/navidrome/pull/4096 issue tracking