-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in playlist management endpoints. The PoC demonstrates attackers can modify the 'ownerId' parameter in PUT requests to change playlist ownership. This indicates the update handler (UpdatePlaylist) doesn't validate if the authenticated user has rights to modify ownership. The CreatePlaylist function is also suspect as initial ownership assignment might be vulnerable, though the PoC focuses more on updates. Both would be in playlist-related handlers, likely in the main API route file. The high confidence for UpdatePlaylist comes from explicit PoC evidence, while CreatePlaylist gets medium confidence based on attack pattern consistency.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/navidrome/navidrome | go | < 0.52.0 | 0.52.0 |