PatchTheCVE: navidrome

CVE-2026-25579: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 10:24:53 +0000

MEDIUM 6.5: Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/). When processing such requests,

CVE-2026-25578: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 10:24:53 +0000

MEDIUM 6.1: Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in v

CVE-2025-48949: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 09:30:32 +0000

CRITICAL 9.8: Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially

CVE-2025-48948: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 09:30:32 +0000

MEDIUM 6.5: Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifyi

CVE-2025-27112: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 09:03:03 +0000

MEDIUM 6.5: Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, al

CVE-2024-56362: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 08:12:06 +0000

HIGH 7.1: Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This

CVE-2024-47062: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 07:56:28 +0000

HIGH 8.8: Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not

CVE-2024-41259: Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulat

Wed, 17 Jun 2026 07:47:31 +0000

CRITICAL 9.1: Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.

CVE-2024-32963: Navidrome is an open source web-based music collection server and streamer

Wed, 17 Jun 2026 07:30:46 +0000

MEDIUM 4.2: Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacker is able to change the parameter values