Privilege Escalation Vulnerability in Gonic Media Server by Sentriz

CVE-2026-86118

What is CVE-2026-86118?

The Gonic media server, in versions prior to 0.22.0, contains a significant vulnerability where the startScan endpoint does not adequately validate administrator privileges. This oversight permits any authenticated user to invoke media library rescans. An attacker can exploit this by repeatedly calling the startScan endpoint, leading to intensive CPU and I/O operations that may result in denial of service for multi-user instances. Administrators should ensure they upgrade to version 0.22.0 or later to mitigate this risk.

References