Black Candy
Monthly
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.