CVE-2026-119596: UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

Published Oct 30, 2026

Updated

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated UNIT3D user can exploit it. The attacker does not need interaction from the playlist owner and can target other members' private playlists.

What does an attacker need to do to access private playlist data?

The attacker can enumerate sequential playlist IDs and request the /playlist-zips/{playlist} endpoint. Successful requests return ZIP files containing the playlist's torrents, disclosing private collection membership.

Are unauthenticated visitors affected?

The described attack requires an authenticated user account. The available information does not indicate that unauthenticated access can exploit the endpoint.

How can administrators look for possible exploitation?

Review requests to /playlist-zips/{playlist} for authenticated accounts accessing many sequential or unrelated playlist IDs. ZIP downloads for playlists not owned by or authorized for the requesting account are consistent with the described behavior.

CVE-2026-119596: UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access private playlist data?

Are unauthenticated visitors affected?

How can administrators look for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access private playlist data?

Are unauthenticated visitors affected?

How can administrators look for possible exploitation?