CVE-2026-86118CWE-862broken-access-control

CVE-2026-86118

Medium · published September 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-05T14:16Z
References (7)
https://github.com/sentriz/gonic · [email protected]https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go · [email protected]https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go · [email protected]https://github.com/sentriz/gonic/releases/tag/v0.22.0 · [email protected]https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq · [email protected]https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint · [email protected]https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
    cvelistv5