id: GO-2025-3733
modules:
    - module: github.com/navidrome/navidrome
      versions:
        - fixed: 0.56.0
      vulnerable_at: 0.55.2
summary: Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
cves:
    - CVE-2025-48948
ghsas:
    - GHSA-f238-rggp-82m3
references:
    - advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-f238-rggp-82m3
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-48948
    - fix: https://github.com/navidrome/navidrome/commit/e5438552c63fecb6284e1b179dddae91ede869c8
    - fix: https://github.com/navidrome/navidrome/pull/4096
source:
    id: GHSA-f238-rggp-82m3
    created: 2025-06-03T13:21:13.171219-04:00
review_status: UNREVIEWED