CVE-2026-97061: Black Candy through 3.2.1 Information Disclosure via Playlist Search
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Black Candy user can exploit it. No administrative privileges or user interaction are required.
What information can be exposed?
An attacker can enumerate playlist names belonging to other users on the same instance. The issue affects playlist search results rather than the playlist data itself, based on the available information.
How can an affected instance be tested?
While authenticated as a non-owner user, query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters. Receiving playlist names owned by other users indicates that search results are not correctly scoped to the session user.
Are default deployments affected?
The issue is described as affecting Black Candy through version 3.2.1, but the available information does not identify any configuration prerequisite. Any deployment that permits authenticated users to access the affected playlist search endpoints should be assessed.