There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、95480188-6ebc-11f0-8a78-bf201f293bce のアドバイザリに記載されている脆弱性の影響を受けます。

    Deluan Quinto 氏による報告
    Navidrome の権限検証の欠陥により、認証された正規ユーザーが、承認チェックをバイパスし、トランスコード設定の作成、変更、削除などの、管理者専用のトランスコード構成操作を実行する可能性があります。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 95480188-6ebc-11f0-8a78-bf201f293bce advisory.

    Deluan Quinto reports:
    A permission verification flaw in Navidrome allows any authenticated                 regular user to bypass authorization checks and perform                 administrator-only transcoding configuration operations, including                 creating, modifying, and deleting transcoding settings.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/12/4	2026/7/2	critical
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/12/4	2026/7/2	critical
434086	SCA: security update for github.com/navidrome/navidrome (GHSA-f238-rggp-82m3)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/2	high
434086	SCA: security update for github.com/navidrome/navidrome (GHSA-f238-rggp-82m3)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/2	high
243292	FreeBSDnavidrome -- トランスコード権限バイパスの脆弱性95480188-6ebc-11f0-8a78-bf201f293bce	Nessus	FreeBSD Local Security Checks	2025/8/1	2025/8/1	high
243292	FreeBSD : navidrome -- transcoding permission bypass vulnerability (95480188-6ebc-11f0-8a78-bf201f293bce)	Nessus	FreeBSD Local Security Checks	2025/8/1	2025/8/1	high

检测

插件搜索

critical

critical

high

high

high

high