Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 95480188-6ebc-11f0-8a78-bf201f293bce advisory.

    Deluan Quinto reports:
    A permission verification flaw in Navidrome allows any authenticated                 regular user to bypass authorization checks and perform                 administrator-only transcoding configuration operations, including                 creating, modifying, and deleting transcoding settings.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
434086	SCA: security update for github.com/navidrome/navidrome (GHSA-f238-rggp-82m3)	Tenable Cloud Security	SCA Checks	high
434086	SCA: security update for github.com/navidrome/navidrome (GHSA-f238-rggp-82m3)	Tenable Self-Hosted Container Security	SCA Checks	high
243292	FreeBSD : navidrome -- transcoding permission bypass vulnerability (95480188-6ebc-11f0-8a78-bf201f293bce)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-48948

high

Tenable Plugins

critical

critical

high

high

high