Vulnerabilities

TI-2026-20685 CVE-2026-25578 · GHSA-rh3r-8pxm-hg4w

Navidrome is vulnerable to XSS via comment from song metadata

LOW 27

Navidrome is an open source web-based music collection server and streamer.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00338 Published 2026-02-04 Fixed in 0.60.0 CWE-79

TI-2026-20686 CVE-2026-25579 · GHSA-hrr4-3wgr-68x3

Uncontrolled resource consumption in navidrome

MEDIUM 46

Navidrome is an open source web-based music collection server and streamer.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00505 Published 2026-02-04 Fixed in 0.60.0 CWE-400

TI-2025-31087 CVE-2025-48949 · GHSA-5wgp-vjxm-3x2r

Navidrome allows SQL Injection via role parameter

HIGH 80

Navidrome is an open source web-based music collection server and streamer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00508 Published 2025-05-30 Fixed in 0.56.0 CWE-89

TI-2025-31086 CVE-2025-48948 · GHSA-f238-rggp-82m3

Navidrome Transcoding Permission Bypass Vulnerability Report

HIGH 66

Navidrome is an open source web-based music collection server and streamer.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.0051 Published 2025-05-30 Fixed in 0.56.0 CWE-863

TI-2025-19982 CVE-2025-27112 · GHSA-c3p4-vm8f-386p

Navidrome has authentication bypass in Subsonic API with non-existent username

HIGH 70

Navidrome is an open source web-based music collection server and streamer.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00982 Published 2025-02-24 Fixed in 0.54.5 CWE-287

TI-2024-37321 CVE-2024-56362 · GHSA-xwx7-p63r-2rj8

Navidrome Stores JWT Secret in Plaintext in navidrome.db

LOW 38

Navidrome is an open source web-based music collection server and streamer.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00154 Published 2024-12-23 Fixed in 0.54.1 CWE-312

TI-2024-31444 CVE-2024-47062 · GHSA-58vj-cv5w-v4v6

Multiple SQL Injections and ORM Leak in navidrome

HIGH 76

Navidrome is an open source web-based music collection server and streamer.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.04457 Published 2024-09-20 Fixed in 0.53.0 CWE-89

TI-2024-27560 CVE-2024-41259 · GHSA-hrmx-8jjv-g758

Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows…

MEDIUM 48

Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00428 Published 2024-08-01 No fix listed CWE-200

TI-2024-21830 CVE-2024-32963 · GHSA-4jrx-5w4h-3gpm

Parameter Tampering vulnerability in Navidrome

MEDIUM 53

Navidrome is an open source web-based music collection server and streamer.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00413 Published 2024-05-01 Fixed in 0.52.0 CWE-200

TI-2023-28096 CVE-2023-51442 · GHSA-wq59-4q6r-635r

Authentication bypass vulnerability in navidrome's subsonic endpoint

LOW 38

Navidrome is an open source web-based music collection server and streamer.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0069 Published 2023-12-21 Fixed in 0.50.2 CWE-287

TI-2022-07860 CVE-2022-23857 · GHSA-pmcr-2rhp-36hr

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection…

LOW 31

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-01-24 Fixed in 0.47.5 CWE-89

Vulnerabilities

Filters