CVE-2026-86118 — gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can…
Published: 2026-09-05 · CVSS: 5.3 · CVSS 4.0
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7