Vulnerability Description
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/sentriz/gonic
- https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go
- https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_commo
- https://github.com/sentriz/gonic/releases/tag/v0.22.0
- https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq
- https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-c
- https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq
FAQ
What is CVE-2026-86118?
CVE-2026-86118 is a vulnerability with a CVSS score of 4.3 (MEDIUM). gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the st...
How severe is CVE-2026-86118?
CVE-2026-86118 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86118?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.