CVE-2025-48948
📋 TL;DR
CVE-2025-48948 is an authorization bypass vulnerability in Navidrome music server where authenticated regular users can perform administrator-only transcoding configuration operations. This allows unauthorized creation, modification, and deletion of transcoding settings. All Navidrome instances with regular user accounts and transcoding enabled are affected.
💻 Affected Systems
- Navidrome
📦 What is this software?
Navidrome by Navidrome
⚠️ Risk & Real-World Impact
Worst Case
Malicious regular user could modify transcoding settings to execute arbitrary code, potentially leading to full system compromise if transcoding commands are not properly sanitized.
Likely Case
Regular users gain unauthorized administrative access to transcoding configuration, potentially disrupting service availability or altering audio quality settings.
If Mitigated
Limited to unauthorized transcoding configuration changes without escalation to full administrative privileges or system compromise.
🎯 Exploit Status
Exploitation requires authenticated regular user access and knowledge of transcoding configuration endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.56.0
Vendor Advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3
Restart Required: Yes
Instructions:
1. Backup your Navidrome configuration and database. 2. Stop the Navidrome service. 3. Update to version 0.56.0 using your package manager or by downloading from GitHub releases. 4. Restart the Navidrome service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable Transcoding
allTemporarily disable transcoding functionality to prevent exploitation of this vulnerability
Edit navidrome.toml and set EnableTranscoding = false
Restart Navidrome service
Restrict User Access
allRemove or disable regular user accounts until patching can be completed
Edit users.toml or database to disable non-admin accounts
Restart Navidrome service
🧯 If You Can't Patch
- Disable transcoding functionality completely in configuration
- Remove all regular user accounts and operate with admin-only access
🔍 How to Verify
Check if Vulnerable:
Check Navidrome version via web interface or configuration file. If version is below 0.56.0 and transcoding is enabled, the system is vulnerable.Check Version:
Check the About section in Navidrome web interface or examine the server startup logsVerify Fix Applied:
Verify version is 0.56.0 or higher via web interface or configuration. Test that regular users cannot access transcoding configuration endpoints.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /api/transcoding endpoints
- Transcoding configuration changes from non-admin user accounts
- HTTP 200 responses on admin-only endpoints from regular users
Network Indicators:
- POST/PUT/DELETE requests to /api/transcoding/* from non-admin user sessions
- Unusual transcoding-related API calls
SIEM Query:
source="navidrome" AND (uri_path="/api/transcoding" OR uri_path="/api/transcoding/*") AND user_role!="admin"