sentriz gonic

• CVE-2026-86118 Medium 4.3 gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint 0.5%
• CVE-2026-49340 High 8.1 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host 0.3%
• CVE-2026-49338 High 7.1 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) 0.3%
• CVE-2026-49339 High 7.1 Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist 0.3%