MEDIUM 5.3 NVD
CVE-2026-97061
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists o
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.
References
- https://github.com/blackcandy-org/blackcandy
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f
- https://github.com/blackcandy-org/blackcandy/issues/463
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-24 via NVD.
vulnfeed aggregates 11976 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.