Unit3D
Monthly
Authenticated members of a UNIT3D torrent tracker running version 9.2.0 or earlier can download the private playlists of other users by walking sequential playlist IDs at the /playlist-zips/{playlist} endpoint, receiving a zip of every torrent in the targeted collection. The controller action performs no ownership or privacy check, so any ordinary registered account can map private collection membership that the UI is meant to hide, with no user interaction and no integrity or availability impact. Exploitation requires a valid low-privileged account (PR:L); a public technical writeup of the issue exists, and while it is not verified as working exploit code, the attack itself needs only ID enumeration. No CISA KEV entry or confirmed in-the-wild activity was provided, and the vendor has published an upstream fix.
Authenticated members of a UNIT3D torrent tracker running version 9.2.0 or earlier can download the private playlists of other users by walking sequential playlist IDs at the /playlist-zips/{playlist} endpoint, receiving a zip of every torrent in the targeted collection. The controller action performs no ownership or privacy check, so any ordinary registered account can map private collection membership that the UI is meant to hide, with no user interaction and no integrity or availability impact. Exploitation requires a valid low-privileged account (PR:L); a public technical writeup of the issue exists, and while it is not verified as working exploit code, the attack itself needs only ID enumeration. No CISA KEV entry or confirmed in-the-wild activity was provided, and the vendor has published an upstream fix.