CVE-2025-48948

CVE-2025-48948 is a permission verification flaw in Navidrome versions prior to 0.56.0, an open-source web-based music server. This vulnerability allows any authenticated regular user to bypass authorization checks and perform administrator-level transcoding configuration operations, such as creating, modifying, or deleting settings. With a CVSS score of 6.5 (Medium), the attack requires low privileges and network access, leading to a high impact on integrity if transcoding is enabled. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.