7 matches found
CVE-2026-97061
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...
CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...
CVE-2026-97061
Versions of Black Candy up to and including 3.2.1 are vulnerable to an information disclosure flaw. The application fails to scope playlist search queries to the currently authenticated session user. Consequently, any authenticated user can query the SearchController or Search::PlaylistsControlle...
EUVD-2026-85886
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...
CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...
PT-2026-97803
Name of the Vulnerable Software and Affected Versions Black Candy versions prior to 3.2.2 Description An issue exists where playlist search queries are not scoped to the authenticated session user. This allows any authenticated user to enumerate all playlists on the instance. Attackers can use...
CVE-2026-97061: Missing Authorization
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...