Description

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T10:16:43.007Z",
  "pubdate": "2026-09-05T10:16:43.007Z",
  "executiveSummary": "The vulnerability resides in gonic versions prior to 0.22.0, specifically within the startScan endpoint. It is classified as an improper authorization flaw, allowing non-privileged users to invoke administrative-level filesystem operations. By failing to validate the requester's privilege level, the application exposes a critical internal function to any authenticated user. This flaw enables attackers to intentionally trigger resource-intensive media library rescans. In multi-user environments, this facilitates a Denial of Service (DoS) attack, as an attacker can repeatedly invoke the scan operation to induce high CPU and I/O utilization. This can render the application unresponsive, impacting availability for legitimate users. The vulnerability requires a valid user account but necessitates no elevated permissions, making it accessible to any actor with standard access credentials.",
  "technicalDetails": "The root cause of this vulnerability is a missing access control check in the startScan endpoint of the gonic application. The function, which is designed to initiate an expensive filesystem scanning process, does not verify whether the caller possesses administrative privileges before executing the requested logic. Consequently, any authenticated user can bypass authorization constraints and force the application to perform exhaustive read operations across the media library.\nThe exploitation flow is straightforward: an attacker authenticates as a standard user and issues a request to the startScan endpoint. Because the application logic fails to implement a role-based access control (RBAC) check at the handler level, the request is processed as a legitimate administrative action. Upon receipt, the application initiates a full filesystem traversal to refresh the library metadata. By design, these scans are resource-intensive, requiring substantial CPU cycles to process file tags and high I/O throughput to crawl the directory structure.\nThe attack vector is characterized by its high reproducibility and low complexity. An attacker can script multiple concurrent or sequential requests to the startScan endpoint, creating a state of sustained high system load. This effectively starves the application of necessary resources, leading to latency spikes, service timeouts, or full system failure in resource-constrained environments. Because the vulnerability allows for the systematic abuse of legitimate administrative functions, it poses a significant risk to the availability and performance of multi-user gonic instances. There are no secondary validation checks within the backend library scanner logic that restrict the frequency or the privilege context of the triggering user, allowing the exhaustion attack to persist until the application process is overwhelmed or manually restarted."
}