Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86118gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

Medium 4.3

In plain English

A medium-severity missing authorization in gonic from sentriz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

Affected products (as reported)

Vendor	Product	Versions
sentriz	gonic	0 – before 0.22.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-453r-pgfw-h3pq) vendor-advisory
ServeStartScan without an admin check technical-description
/startScan registered on the plain auth chain technical-description
gonic v0.22.0 Release Notes release-notes
https://github.com/sentriz/gonic product
VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint third-party-advisory