CVE-2026-86118

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86118
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86118.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86118
Aliases
  • GHSA-453r-pgfw-h3pq
Published
2026-09-05T09:59:08Z
Modified
2026-09-10T03:30:44Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
Details

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86118.json"
}
References

Affected packages

Git / github.com/sentriz/gonic

Affected ranges

Type
GIT
Repo
https://github.com/sentriz/gonic
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5ae99e8af550e4d5cbd45a3b430419d32cb54aed
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.22.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.16.0-rc1
v0.16.1
v0.16.2
v0.16.3
v0.16.4
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.2.1
v0.20.0
v0.20.1
v0.21.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86118.json"