The vulnerability in gonic arises because the ownership check relies on playlist.UserID, which is derived from the first path segment of the playlist ID controlled by the attacker. Since there is no path containment validation on the resolved file path, an authenticated Subsonic user can exploit this to bypass ownership restrictions. This enables unauthorized access to other users' playlists, deletion of those playlists, and probing of arbitrary file paths on the server. The issue is related to a previous IDOR vulnerability but uses path traversal in the 'id' parameter as the attack vector. The fix was introduced in commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 and included in gonic version 0.21.0.

An authenticated user can bypass playlist ownership checks, allowing them to read and delete playlists belonging to other users and probe arbitrary file paths on the host system. This leads to unauthorized information disclosure and modification of user data. The vulnerability does not impact availability but compromises confidentiality and integrity of user playlists and potentially exposes sensitive files on the server.

Upgrade to gonic version 0.21.0 or later, where the vulnerability is fixed by proper path containment checks and ownership validation. No other mitigations are indicated or required as the fix addresses the root cause.