Navidrome Transcoding Permission Bypass Vulnerability Report
Date: 2025-05
Affected: go/github.com/navidrome/navidrome
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-48948
CWE: CWE-863

### Summary A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. ### Details Navidrome supports transcoding functionality which, although disabled by default, should restrict configuration operations to administrators only. However, the application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests. The vulnerability exists in the API endpoints that manage transcoding settings. When a regular user sends requests to these endpoints, the application processes them without verifying if the user has administrative privileges, despite the JWT token clearly indicating the user is not an administrator (`"adm":false`). The affected endpoints include: - `POST /api/transcoding` (Create transcoding configuration) - `PUT /api/transcoding/:id` (Update transcoding configuration) - `DELETE /api/transcoding/:id` (Delete transcoding configuration) - `GET /api/transcoding` (List transcoding configurations) ### PoC 1. Set up Navidrome with transcoding enabled 2. Log in as a regular user (non-administrator) 3. Send the following HTTP request: ``` POST /api/transcoding HTTP/1.1 Host: 192.168.199.134:4533 Content-Length: 81 x-nd-client-unique-id: e559d130-4295-401e-b65f-be7fdd564e accept: application/json x-nd-authorization: Bearer


Mitigations:

Architectural layers (MAESTRO):