CVE-2026-86118: Gonic Media Server DOS Vulnerability

CVE-2026-86118 Overview

CVE-2026-86118 affects gonic, an open-source Subsonic-compatible music server, in versions prior to 0.22.0. The startScan endpoint fails to validate administrator privileges before initiating a media library rescan. Any authenticated user can invoke the endpoint to trigger CPU and I/O-intensive filesystem operations. Repeated requests cause resource exhaustion and denial of service on multi-user instances. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated low-privilege users can repeatedly force full media library scans, exhausting CPU and disk I/O on shared gonic instances.

Affected Products

gonic versions prior to 0.22.0
Subsonic API startScan endpoint in server/ctrlsubsonic/handlers_common.go
Multi-user gonic deployments serving non-administrator accounts

Discovery Timeline

2026-09-05 - CVE-2026-86118 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86118

Vulnerability Analysis

gonic exposes a Subsonic-compatible HTTP API that includes a startScan operation for refreshing the server's media library index. In releases up to and including v0.21.0, the handler defined in server/ctrlsubsonic/handlers_common.go and registered in server/ctrlsubsonic/ctrl.go does not verify that the calling user holds administrator privileges. Any account with valid Subsonic credentials can invoke the endpoint.

A library rescan traverses the configured music directories, reads file metadata, parses tags, and writes to the underlying database. These operations are CPU-bound during tag parsing and I/O-bound during directory traversal. When triggered repeatedly, they saturate server resources and degrade playback and API responsiveness for other users. See the GitHub Security Advisory GHSA-453r-pgfw-h3pq for the maintainer's write-up.

Root Cause

The root cause is a missing authorization check [CWE-862] on a privileged administrative action. The handler validates authentication but not role membership. Administrative endpoints must enforce both authentication and role-based authorization before performing state-changing operations.

Attack Vector

Exploitation requires network access to the gonic Subsonic API and any valid non-administrator user account. An attacker submits repeated HTTP requests to the startScan endpoint. Each request queues or triggers a full media library rescan, consuming CPU and disk I/O until the server becomes unresponsive. No user interaction from an administrator is required.

// No verified public exploit code is available for CVE-2026-86118.
// Refer to the VulnCheck advisory and the GitHub security advisory
// linked in the References section for behavioral details.

Detection Methods for CVE-2026-86118

Indicators of Compromise

Repeated HTTP requests to /rest/startScan.view (and related Subsonic API paths) originating from a single authenticated non-admin user within a short window.
Sustained high CPU and disk I/O on the gonic host correlated with scan activity in gonic logs.
Multiple concurrent or back-to-back "scan started" entries in gonic application logs attributed to non-administrator accounts.

Detection Strategies

Parse gonic access logs for startScan invocations and alert when a non-admin account calls the endpoint more than a defined threshold per hour.
Correlate Subsonic API request rates with host-level CPU and I/O utilization to surface resource-exhaustion patterns.
Track the gonic version in inventory data and flag hosts running releases earlier than 0.22.0.

Monitoring Recommendations

Ship gonic HTTP access and application logs to a centralized logging or SIEM platform for retention and analytics.
Monitor process-level CPU, memory, and disk I/O for the gonic service and alert on sustained saturation.
Track authentication events per account and correlate spikes with administrative endpoint calls.

How to Mitigate CVE-2026-86118

Immediate Actions Required

Upgrade gonic to version 0.22.0 or later, which adds the missing administrator check on the startScan endpoint. See the gonic v0.22.0 release notes.
Audit existing gonic user accounts and remove or rotate credentials for accounts that are no longer required.
Restrict network exposure of the gonic Subsonic API to trusted networks or place it behind an authenticating reverse proxy.

Patch Information

The upstream fix is included in gonic v0.22.0. The maintainer's advisory is published as GHSA-453r-pgfw-h3pq, and a third-party write-up is available in the VulnCheck advisory. Administrators running versions up to v0.21.0 should plan an upgrade window and validate library integrity after updating.

Workarounds

Front the gonic instance with a reverse proxy that rate-limits requests to the startScan endpoint per authenticated user.
Limit gonic accounts to trusted users and disable self-registration where applicable.
Isolate the gonic service in a resource-constrained container or cgroup to bound the impact of runaway scans.

bash

# Example nginx snippet to rate-limit the Subsonic startScan endpoint
limit_req_zone $binary_remote_addr zone=gonic_scan:10m rate=1r/m;

location ~* /rest/startScan {
    limit_req zone=gonic_scan burst=2 nodelay;
    proxy_pass http://127.0.0.1:4747;
}