What’s Vulnerable › Vulnerabilities

CVE-2025-48948: Navidrome Transcoding Permission Bypass Vulnerability Report

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-30 · updated 2026-06-17
• Weakness: CWE-863

Description

Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.

Affected products

• navidrome: before 0.56.0 — fixed in 0.56.0

How to fix

Upgrade to a fixed version: navidrome 0.56.0. Check the vendor advisory for mitigations.

References

• https://github.com/navidrome/navidrome/commit/e5438552c63fecb6284e1b179dddae91ede869c8
• https://github.com/navidrome/navidrome/pull/4096
• https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3

Get alerted when CVE-2025-48948 or the next vulnerability affects your stack