UNIT3D EUVD-2026-113933

Requires a valid authenticated account on the UNIT3D tracker (any ordinary registered member; PR:L), reachable over the network with no user interaction. The targeted playlist must be marked private and owned by a different user; exploitation works against default configurations of UNIT3D through 9.2.0 where PlaylistZipController::show lacked an ownership/private check. Limiting factors: the attacker must be logged in, moderators/admins (group->is_modo) legitimately retain access and are not the attack population, and impact is confined to disclosure of private playlist membership and the included torrents - there is no integrity or availability impact and no takeover of other accounts.

This is a medium-severity information-disclosure issue (vendor CVSS 4.0 base 5.3) whose real-world priority is moderate, not critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reach with low attack complexity and no user interaction, but PR:L means a valid authenticated member account is required, so this is not pre-auth. Impact is confidentiality-only and rated Low (VC:L, VI:N, VA:N) - it discloses private playlist/torrent membership, not credentials or system control. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The CVE is not listed in CISA KEV, so there is no confirmed active exploitation. A public technical writeup (hackmd) and a VulnCheck advisory exist; these are analysis/PoC references and are not verified as working exploit code. The vuln.today Decision label is 'this_month', which is consistent with the medium severity and the fact that a fix is already available - treat this as a scheduled patch item, not an emergency. Signals are largely consistent (medium CVSS, no KEV, moderate decision urgency); the main gap is the absence of an EPSS value to gauge likelihood, and the PoC reference is unverified rather than confirmed working code.

An authenticated member of a UNIT3D-based tracker loops through sequential integer playlist IDs at the /playlist-zips/{playlist} endpoint. Because PlaylistZipController::show did not check ownership or the private flag, the server returns a zip of torrents for playlists belonging to other users, revealing their private collection membership. A public PoC reference exists (hackmd writeup and VulnCheck advisory); it is not verified as working exploit code.