CVE-2026-86118

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.22.0

Description Authenticated users can trigger media library rescans because the software fails to validate administrator privileges at the 'startScan' endpoint. By repeatedly calling this endpoint, an attacker can force CPU and I/O-intensive filesystem operations, leading to a denial of service on multi-user instances.

Recommendations Update to version 0.22.0 or later. As a temporary workaround, restrict access to the 'startScan' endpoint to prevent unauthorized users from triggering rescans.