CVE-2026-86118
gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 5, 2026
Description
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
gonicsentriz |
|
References
- GitHub Security Advisory (GHSA-453r-pgfw-h3pq)vendor-advisory
- ServeStartScan without an admin checktechnical-description
- /startScan registered on the plain auth chaintechnical-description
- gonic v0.22.0 Release Notesrelease-notes
- https://github.com/sentriz/gonicproduct
- VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.