Vulnerabilities

TI-2026-58917 CVE-2026-86118 · GHSA-58w8-8f5r-987p

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

MEDIUM 57

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00473 Published 2026-09-05 Fixed in 0.22.0 CWE-862

TI-2026-36518 CVE-2026-49340 · GHSA-4gxv-p5g5-j7w7

Path traversal in sentriz gonic

HIGH 70

gonic is a music streaming server / free-software subsonic server API implementation.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-06-19 Fixed in 0.21.0 CWE-22

TI-2026-36516 CVE-2026-49338 · GHSA-hmgp-w9jm-vp95

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

MEDIUM 64

gonic is a music streaming server / free-software subsonic server API implementation.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00288 Published 2026-06-19 Fixed in 0.21.0 CWE-285

TI-2026-36517 CVE-2026-49339 · GHSA-2fp4-5v5c-4448

Path traversal in sentriz gonic

MEDIUM 64

gonic is a music streaming server / free-software subsonic server API implementation.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00313 Published 2026-06-19 Fixed in 0.21.0 CWE-22

Vulnerabilities

Filters

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

Path traversal in sentriz gonic

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

Path traversal in sentriz gonic