Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fc2d2fb8-4c83-11f0-8deb-f8f21e52f724 advisory.

    Deluan reports:
    This vulnerability arises due to improper input validation on the role parameter within the API endpoint     /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining     unauthorized access to the backend database and compromising sensitive user information.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
434771	SCA: security update for github.com/navidrome/navidrome (GHSA-5wgp-vjxm-3x2r)	Tenable Cloud Security	SCA Checks	critical
434771	SCA: security update for github.com/navidrome/navidrome (GHSA-5wgp-vjxm-3x2r)	Tenable Self-Hosted Container Security	SCA Checks	critical
240188	FreeBSD : Navidrome -- SQL Injection via role parameter (fc2d2fb8-4c83-11f0-8deb-f8f21e52f724)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2025-48949

critical

Tenable Plugins

critical

critical

critical

critical

critical