High · published May 30, 2025
⚡ The role parameter in Navidrome's API has a gaping security hole that could allow attackers to inject SQL queries like a sneaky DJ slipping in a track nobody approved! 🎧 Think of it as a restaurant where the chef accepts any order without checking the menu — that means anyone can request whatever dish they want, regardless of it being on the menu or not! With this vulnerability, an attacker could potentially waltz in and access sensitive data stored in the backend database, exposing user information that should remain private. This could lead to unauthorized access and even data breaches, which is absolutely devastating for both users and the service.
Think of it as a restaurant where the chef accepts any order without checking the menu — that means anyone can request whatever dish they want, regardless of it being on the menu or not! This vulnerability arises from improper input validation on the `role` parameter within the `/api/artist` endpoint, allowing attackers to inject arbitrary SQL queries into the database, bypassing security measures entirely.
With this vulnerability, an attacker could potentially waltz in and access sensitive data stored in the backend database, exposing user information that should remain private. This could lead to unauthorized access and even data breaches, which is absolutely devastating for both users and the service. To secure your Navidrome installation, immediately upgrade to version 0.56.0 where this issue has been patched. Additionally, review your API input validation processes to ensure no other parameters are left vulnerable. You've got this! Follow these steps and your Navidrome will be rocking a secure setup in no time! 🛡️