Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) (CVE-2026-49338) | HOL Guard CVE