This vulnerability allows any authenticated Subsonic user to read or delete any other user's playlist and probe arbitrary file paths on the host. The flaw is a path traversal in the playlist ID parameter combined with an insufficient ownership check. Because the UserID used for authorization is derived from the path segment, an attacker can bypass the check, leading to information disclosure and potential manipulation of user data. The weakness aligns with CWE-22 and CWE-639.

The affected product is sentriz:gonic, a music streaming server implementing the Subsonic API. All releases before version 0.21.0 contain the flaw; the patch introduced in commit 6dd71e6 and finalized in commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 removes the vulnerability. Users running older versions of gonic should be aware that any authenticated user may retrieve, delete, or check existence of files on the filesystem linked to the playlist IDs.

The CVSS score of 7.1 reflects considerable impact without remote code execution. EPSS is not available but the nature of the flaw makes it likely to be abused by attackers who already have authenticated access. The vulnerability is not listed in the CISA KEV catalog, but it poses a significant risk to confidentiality, integrity, and availability of user data. The likely attack vector is through API calls to getPlaylist or deletePlaylist using crafted playlist IDs; no additional credentials beyond normal authentication are required.