The vulnerability arises because the ownership check in gonic relies on playlist.UserID, which is derived from the first path segment of the playlist ID controlled by the attacker. Since there is no path containment validation on the resolved file path, an authenticated user can exploit path traversal to access or delete other users' playlists and probe arbitrary file paths. This bypasses the intended boundary enforcement introduced in a prior fix. The issue is addressed by commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in gonic version 0.21.0.

An authenticated Subsonic user can bypass playlist ownership restrictions to read or delete playlists belonging to other users. Additionally, the attacker can probe arbitrary file paths on the server for existence or readability, potentially exposing sensitive information. The vulnerability does not allow remote unauthenticated access but does enable significant unauthorized access and information disclosure within the authenticated user context.

Upgrade gonic to version 0.21.0 or later, where this vulnerability is fixed. The fix includes proper path containment checks preventing path traversal attacks on playlist IDs. No other mitigation is indicated by the vendor advisory.