Vulnerability Description
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/blackcandy-org/blackcandy
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6
- https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6
- https://github.com/blackcandy-org/blackcandy/issues/463
- https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-discl
FAQ
What is CVE-2026-97061?
CVE-2026-97061 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the ...
How severe is CVE-2026-97061?
CVE-2026-97061 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-97061?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.