x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-wq59-4q6r-635r

[GoVulnBot]

In GitHub Security Advisory GHSA-wq59-4q6r-635r, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/navidrome/navidrome	0.50.2	<= 0.50.1

Cross references:

• Module github.com/navidrome/navidrome appears in issue x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2022-23857 #302 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/navidrome/navidrome
      versions:
        - introduced: TODO (earliest fixed "0.50.2", vuln range "<= 0.50.1")
      packages:
        - package: github.com/navidrome/navidrome
summary: Authentication bypass vulnerability in navidrome's subsonic endpoint
cves:
    - CVE-2023-51442
ghsas:
    - GHSA-wq59-4q6r-635r
references:
    - advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r
    - fix: https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c
    - advisory: https://github.com/advisories/GHSA-wq59-4q6r-635r

[jba]

Output from dependency tool:

module github.com/navidrome/navidrome
    package core/auth
        9 direct importers (9 from the same module)
        1 main importer in 1 module
            this module: 1 main: (root)
    package server
        5 direct importers (5 from the same module)
        1 main importer in 1 module
            this module: 1 main: (root)

[gopherbot]

Change https://go.dev/cl/553636 mentions this issue: data/excluded: batch add 6 excluded reports

[gopherbot]

Change https://go.dev/cl/592764 mentions this issue: data/reports: unexclude 31 reports

[gopherbot]

Change https://go.dev/cl/606793 mentions this issue: data/reports: unexclude 15 reports (12)