CVE-2026-97061CWE-862broken-access-control

CVE-2026-97061

Medium · published September 24, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-24T18:18Z
References (6)
https://github.com/blackcandy-org/blackcandy · [email protected]https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5 · [email protected]https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9 · [email protected]https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21 · [email protected]https://github.com/blackcandy-org/blackcandy/issues/463 · [email protected]https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-search · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 13:52Z
    Black Candy through 3.2.1 Information Disclosure via Playlist Search
    cvelistv5