EUVD-2026-85886
GHSA-8g7p-g3x7-hm9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Black Candy instance
-
ExploitSend search request with blank/targeted term
-
ExecutionServer omits per-user playlist scoping
-
ImpactEnumerate all users' playlist names
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the target Black Candy instance (PR:L) and network reachability to the web application; no user interaction is needed. Exploitation works against default configurations by querying the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters, since playlist search is not scoped to the session user. The limiting factor is that the attacker must first be an authenticated user and the disclosure is confined to other users' playlist names - no content, credentials, integrity, or availability impact. |
| Impact | This is a low-to-moderate severity information-disclosure issue, not a high-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L, no integrity or availability impact) correctly frames it as a read-only authorization gap: any already-authenticated user of the instance can enumerate other users' playlist names. There is no CISA KEV listing, no EPSS score supplied, and no public exploit code referenced - so the exploitation status is 'no public exploit identified at time of analysis.' The PR:L requirement (a valid account on the instance) and the limited confidentiality impact (playlist names only - CWE-862 missing authorization, not credential or content theft) keep real-world risk low. The signals are internally consistent; the only friction is the 'Authentication Bypass' tag, which overstates the flaw - this is a horizontal authorization/IDOR-style leak by an authenticated user, not a bypass of authentication itself. Verify the PR:L assumption against the deployment (Black Candy supports self-registration in some setups, which would lower the practical barrier). |
| Exploit ScenarioDerived | An attacker who registers or already holds a low-privilege account on a self-hosted Black Candy instance sends requests to the SearchController or Search::PlaylistsController with blank or targeted search terms. Because the query is not scoped to the session user, the response returns playlist names belonging to every other user on the instance. No public exploit code is referenced, but the attack is a trivial authenticated HTTP request requiring no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis; affected deployments should monitor the upstream repository (https://github.com/blackcandy-org/blackcandy) and issue https://github.com/blackcandy-org/blackcandy/issues/463, and upgrade to the first release that scopes playlist search to the session user as soon as it is published - versions through 3.2.1 must be treated as vulnerable until that fix is confirmed. If upgrading immediately is not possible, the most direct compensating control is to restrict who can hold an account on the instance, since exploitation requires an authenticated session: disable open self-registration and remove or disable dormant accounts, accepting the operational cost that legitimate new users must be provisioned manually. Network exposure can also be reduced by placing the instance behind an authenticating reverse proxy, VPN, or IP allow-list so only trusted clients reach the search endpoints, at the cost of breaking public or mobile access. Administrators able to maintain a local fork can backport the authorization fix directly into app/models/concerns/searchable_concern.rb so that playlist searches are constrained to current_user's records, or temporarily disable the playlist search routes in config/routes.rb; both approaches require ongoing patch maintenance against upstream changes and may break the in-app search feature for legitimate users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Black Candy is a self-hosted Ruby on Rails music streaming server, identified by the CPE cpe:2.3:a:blackcandy-org:black_candy:*:*:*:*:*:*:*:* covering all releases through 3.2.1. The root cause is CWE-862 (Missing Authorization): the shared search implementation in app/models/concerns/searchable_concern.rb (line 21) builds playlist search queries without filtering on the currently authenticated user, and the controllers app/controllers/search_controller.rb (line 9) and app/controllers/search/playlists_controller.rb (line 5) expose that unscoped query directly to any logged-in session. Because the query is not joined or constrained against the playlist owner, calling the search endpoints with an empty or crafted term returns a cross-tenant result set of playlist names. This is a horizontal authorization-scoping defect rather than an authentication bypass; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) both reflect a low-confidentiality disclosure reachable over the network by an authenticated principal with no user interaction required.
Know when Black Candy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user (PR:L) sends a simple remote request (AV:N/AC:L) leaking only playlist names, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB