CVE-2026-86118: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gonicto a version that resolves this vulnerability.Fixed in 0.22.0 - Configuration
Update gonic so the /startScan endpoint validates administrator privileges; non-administrator authenticated users must be prevented from triggering media library rescans.
gonic startScan endpoint administrator privilege check = enforce (reject non-administrator users)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated gonic user can trigger media library rescans through the startScan endpoint; administrator privileges are not required in affected versions.
What access does an attacker need?
The attacker needs valid authenticated access to a gonic instance and network access to its Subsonic endpoint. No user interaction is required.
What is the operational impact of exploitation?
Repeated scan requests can force CPU- and I/O-intensive filesystem operations, potentially causing denial of service on multi-user instances.
Which versions are affected?
gonic versions before 0.22.0 are affected.