Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.
Affected: Go: github.com/navidrome/navidrome
### Summary A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings.
### Details Navidrome supports transcoding functionality which, although disabled by default, should restrict configuration operations to administrators only. However, the application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests.
The vulnerability exists in the API endpoints that manage transcoding settings. When a regular user sends requests to these endpoints, the application processes them without verifying if the user has administrative privileges, despite the JWT token clearly indicating the user is not an administrator (`"adm":false`).
The affected endpoints include: - `POST /api/transcoding` (Create transcoding configuration) - `PUT /api/transcoding/:id` (Update transcoding configuration) - `DELETE /api/transcoding/:id` (Delete transcoding configuration) - `GET /api/transcoding` (List transcoding configurations)
### PoC 1. Set up Navidrome with transcoding enabled 2. Log in as a regular user (non-administrator) 3. Send the following HTTP request:
``` POST /api/transcoding HTTP/1.1 Host: 192.168.199.134:4533 Content-Length: 81 x-nd-client-unique-id: e559d130-4295-401e-b65f-be7fdd564e accept: application/json x-nd-authorization: Bearer…
govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media