CVE-2026-86118

EUVD-2026-71950
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/sentriz/gonic
https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go
https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go
https://github.com/sentriz/gonic/releases/tag/v0.22.0
https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq
https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint