CVE-2026-86118
Received Received - Intake

Gonic Media Server Privilege Escalation Leads to DoS

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86118
EUVD
EUVD-2026-71950

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sentriz gonic to 0.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86118 is a vulnerability in gonic versions before 0.22.0 where the startScan endpoint fails to validate administrator privileges. Any authenticated user can trigger media library rescans, causing CPU and I/O-intensive filesystem operations that lead to denial of service on multi-user instances.

Detection Guidance

Check if your gonic version is below 0.22.0 by running: gonic --version or checking the web interface. Monitor API logs for repeated calls to /rest/startScan.view from non-admin users. Use network monitoring tools to detect unusual CPU or I/O usage spikes during scans.

Impact Analysis

Attackers can repeatedly call the startScan endpoint to force resource-intensive rescans, degrading server performance and causing denial of service. This affects multi-user instances by consuming excessive CPU and I/O resources.

Mitigation Strategies

Upgrade gonic to version 0.22.0 or later immediately. If upgrading is not possible, restrict access to the /rest/startScan.view endpoint by modifying server configurations or firewall rules to block non-admin requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart