CVE-2026-119596
Received Received - Intake

UNIT3D Missing Authorization in PlaylistZipController

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119596
EUVD
EUVD-2026-113933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
HDInnovations UNIT3D 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

UNIT3D versions up to 9.2.0 have a missing authorization flaw in the PlaylistZipController::show function. Authenticated users can exploit this to download private playlists belonging to other members by guessing sequential playlist IDs at the /playlist-zips/{playlist} endpoint, exposing private torrent collections.

Detection Guidance

Check for unauthorized access to playlist-zips/{playlist} endpoints by monitoring HTTP requests to this path. Look for sequential playlist ID enumeration attempts in server logs. Test by accessing /playlist-zips/{playlist} with different IDs to see if private playlists are exposed.

Impact Analysis

If you use UNIT3D, attackers could access your private playlist data, revealing your torrent collection membership. This could lead to privacy breaches, unauthorized exposure of your interests, or potential targeting based on disclosed content.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by exposing personal data (playlist contents) without consent. For organizations handling sensitive data, it may also conflict with HIPAA if user activity logs or preferences are exposed.

Mitigation Strategies

Apply vendor patches or updates for UNIT3D 9.2.0 or later. Restrict access to /playlist-zips/{playlist} endpoints by implementing proper authorization checks. Review server logs for past exploitation attempts and remove any unauthorized playlist downloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart