The gonic music streaming server allows authenticated users to access the Subsonic API endpoints \/rest\/deletePlaylist.view and \/rest\/getPlaylist.view without checking ownership of the referenced playlist. This allows any logged‑in user to delete any other user’s playlist or read the contents of a private playlist. The ability to delete a playlist is a loss of availability for cataloged media, while the exposure of private playlist information compromises confidentiality and may reveal personal listening habits.

The vulnerability affects gonic versions prior to 0.21.0. Users running any release 0.20.x or earlier are vulnerable. The issue was addressed in commit 6dd71e6a3c966867ef8c900d359a7df75789f410, which is included in the 0.21.0 release. The product is provided by the vendor sentriz under the gonic project name.

The CVSS base score is 7.1, indicating a high severity vulnerability. Because the attack requires only authentication, an attacker with any user account can enumerate playlist IDs by guessing the base64‑encoded <userID>/<filename>.m3u pattern; these IDs are frequently exposed, making the attack practical. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, yet its high likelihood of exploitation in multi‑user environments warrants timely remediation.