The vulnerability in gonic (CVE-2026-49338) involves improper authorization (CWE-285) in the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` prior to version 0.21.0. Authenticated users, regardless of privilege level, can delete any playlist owned by other users or read the full contents of private playlists by guessing or obtaining the playlist ID, which is a base64url encoding of `<userID>/<filename>.m3u`. Because user IDs are small integers and filenames are user-supplied or time-derived, these IDs are guessable or may be exposed from previously public playlists. This vulnerability allows low-privileged users to bypass access controls, compromising confidentiality and integrity of playlists, including those of administrators. The vulnerability was fixed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410, included in gonic version 0.21.0.

An attacker authenticated as any user can delete playlists owned by other users, including administrators, and read private playlist contents without authorization. This compromises confidentiality and integrity of user data and breaks the multi-user trust model of gonic. There is no indication of availability impact. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

Upgrade gonic to version 0.21.0 or later, which includes the fix for this improper authorization vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in 0.21.0.