VULNERABILITY INTELLIGENCE
CVE-2026-86118
CVSS score5.3 MEDIUM
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-09-05
Last modified2026-09-16
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Weakness classification
- CWE-862: Missing Authorization