CVE-2025-48948
Medium
Description
Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.
SeverityMedium
CVSS6.5
Exploit probability—
ProductNavidrome
PublishedMay 30, 2025
First seenMay 30, 2025
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- navidrome navidrome0.56.0 or later
- github.com/navidrome/navidrome0.56.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| navidrome navidrome | v < 0.56.0 | 0.56.0 |
| github.com/navidrome/navidromeGo | v < 0.56.0 | 0.56.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.