gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
sentriz · gonicReferences
https://github.com/sentriz/gonichttps://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.gohttps://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.gohttps://github.com/sentriz/gonic/releases/tag/v0.22.0https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pqhttps://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint