CVE-2025-48948: Github.com/navidrome/navidrome Navidrome Transcoding Permission Bypass Vulnerability Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f238-rggp-82m3",
  "modified" : "2025-05-30T21:42:28Z",
  "published" : "2025-05-29T22:36:49Z",
  "aliases" : [ "CVE-2025-48948" ],
  "summary" : "Navidrome Transcoding Permission Bypass Vulnerability Report",
  "details" : "### Summary\nA permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings.\n\n### Details\nNavidrome supports transcoding functionality which, although disabled by default, should restrict configuration operations to administrators only. However, the application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests.\n\nThe vulnerability exists in the API endpoints that manage transcoding settings. When a regular user sends requests to these endpoints, the application processes them without verifying if the user has administrative privileges, despite the JWT token clearly indicating the user is not an administrator (`\"adm\":false`).\n\nThe affected endpoints include:\n- `POST /api/transcoding` (Create transcoding configuration)\n- `PUT /api/transcoding/:id` (Update transcoding configuration)\n- `DELETE /api/transcoding/:id` (Delete transcoding configuration)\n- `GET /api/transcoding` (List transcoding configurations)\n\n### PoC\n1. Set up Navidrome with transcoding enabled\n2. Log in as a regular user (non-administrator)\n3. Send the following HTTP request:\n\n```\nPOST /api/transcoding HTTP/1.1\nHost: 192.168.199.134:4533\nContent-Length: 81\nx-nd-client-unique-id: e559d130-4295-401e-b65f-be7fdd564e\naccept: application/json\nx-nd-authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhZG0iOmZhbHNlLCJleHAiOjE3NDY2MzIyNDEsImlhdCI6MTc0NjQ1ODk5NiwiaXNzIjoiTkQiLCJzdWIiOiJ1c2VyMSIsInVpZCI6InV3THJGcWxXNHhnNEt4QjNxMk85eTYifQ.jqv2eESY8QTAHY-oLbBmO0v8IyDXrofvXqQgXSrJ6SM\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36\ncontent-type: application/json\nOrigin: http://192.168.199.134:4533\nReferer: http://192.168.199.134:4533/app/\nAccept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9\n\n{\"defaultBitRate\":192,\"name\":\"trans6\",\"command\":\"tran6\",\"targetFormat\":\"tran6\"}\n```\n\n4. The request will succeed despite the JWT token clearly indicating the user is not an administrator (`\"adm\":false`)\n5. The same operation can be performed with administrator credentials, confirming that no authorization check is being performed\n\n### Impact\nThis vulnerability allows regular users to modify critical system configurations that should be restricted to administrators only. While Navidrome does not recommend enabling transcoding in production environments, when it is enabled, proper authorization checks should still be enforced.\n\nThe security impact includes:\n1. **Privilege Escalation**: Regular users can perform administrator-only actions\n2. **System Configuration Tampering**: Unauthorized users can modify transcoding settings, potentially affecting system performance or functionality\n3. **Potential Command Injection**: Since transcoding settings include command parameters, this could potentially lead to command injection if not properly sanitized\n\nIn the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/navidrome/navidrome"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.56.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.55.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-48948"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/navidrome/navidrome/pull/4096"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/navidrome/navidrome/commit/e5438552c63fecb6284e1b179dddae91ede869c8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/navidrome/navidrome"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-29T22:36:49Z",
    "nvd_published_at" : "2025-05-30T20:15:43Z"
  }
}