CVE-2026-49338

## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as *any* user (admin or not), an attacker can: 1. **Delete any playlist owned by any other user** (including admin) by passing its `id`. 2. **Read the full contents** (name, comment, song list) of any other user's **private** (non-public) playlist by passing its `id`. The Subsonic playlist `id` is `base64url("<userID>/<filename>.m3u")`. Because filenames are user-supplied or time-derived and the `userID` is a small integer, IDs are guessable and frequently exposed (e.g. a previously-public playlist that was later made private still has the same ID). This breaks the multi-user trust boundary of gonic: a low-privileged user can wipe an administrator's curated playlists, and a user can exfiltrate any private playlist they obtain an ID for. ## Status This was originally disclosed to the maintainer by email and has been **fixed in commit `6dd71e6a3c966867ef8c900d359a7df75789f410`** (`fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist`, 2026-05-18). The fix has not yet been included in a tagged release; the latest tagged version `v0.20.1` is still vulnerable. Filing this advisory now that private vulnerability reporting is enabled on the repo, so the issue has a public record once the next release ships. ## Vulnerable code (pre-fix, at `v0.20.1` / commit `37090aa7`) **Delete IDOR** — `server/ctrlsubsonic/handlers_playlist.go` lines 177-187: ```go func (c *Controller) ServeDeletePlaylist(r *http.Request) *spec.Response { params := r.Context().Value(CtxParams).(params.Params) playlistID, err := params.GetFirstID("id", "playlistId") if err != nil { return spec.NewError(10, "please provide an `id` or `playlistId` parameter") } if err := c.playlistStore.Delete(playlistIDDecode(playlistID)); err != nil { return spec.NewError(0, "delete playlist: %v", er