Executive brief
gonic is a free-software music streaming server compatible with Subsonic. A vulnerability in versions before 0.22.0 allows any authenticated user to trigger media library rescans that should be restricted to administrators only. An attacker can repeatedly call the vulnerable endpoint to consume excessive CPU and disk I/O resources, causing the service to become unresponsive for legitimate users.
Technical details
The startScan endpoint in gonic fails to validate administrator privileges, allowing any authenticated user to initiate CPU and I/O-intensive filesystem operations (media library rescans). The vulnerability exists in the Subsonic API controller and is rooted in missing authorization checks on an administrative function. The attack requires only network access and valid authentication credentials (any user account). An attacker can perform a denial-of-service attack by repeatedly calling startScan on multi-user instances, exhausting system resources. The vulnerability is fixed in version 0.22.0 and later.
Affected products
- sentriz gonic before 0.22.0
Timeline
- 2026-09-05: disclosed