CVE-2026-86118: Missing Authorization in sentriz gonic
Description
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
CVSS v4.0
Score 5.3medium
Affected software
sentriz
gonic
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86118 affects sentriz gonic versions prior to 0.22.0 where the startScan endpoint does not properly validate administrator privileges. As a result, any authenticated user can initiate media library rescans, which are resource-intensive operations. Repeated exploitation can degrade system performance and cause denial of service in environments with multiple users.
Potential Impact
The vulnerability allows authenticated users without proper authorization to trigger expensive filesystem operations repeatedly. This can lead to denial of service conditions due to high CPU and I/O usage, impacting availability on multi-user deployments of gonic.
Mitigation Recommendations
A fix is available in gonic version 0.22.0 and later. Users should upgrade to version 0.22.0 or newer to ensure proper authorization checks on the startScan endpoint and prevent unauthorized rescans.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T01:59:21.710Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9bed73acd9273b49b1c670
Added to database: 09/05/2026, 10:22:43 UTC
Last enriched: 09/25/2026, 02:47:21 UTC
Last updated: 10/18/2026, 06:48:20 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.