CVE-2026-97061
Received Received - Intake

Playlist Enumeration in Black Candy via Unauthorized Search Queries

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97061
EUVD
EUVD-2026-85886

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
black_candy black_candy to 3.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an information disclosure vulnerability in Black Candy through version 3.2.1. It allows any authenticated user to view all playlists on the system, including those belonging to other users, by searching via the SearchController or Search::PlaylistsController endpoints. The issue occurs because playlist search queries are not scoped to the authenticated user's session.

Detection Guidance

To detect this vulnerability, check if unauthenticated or unauthorized users can access playlist data via the SearchController or Search::PlaylistsController endpoints. Use tools like curl to query these endpoints with blank or specific search terms and verify if playlist names from other users are returned. Example: curl -X GET 'http://<target>/search?query=' or curl -X GET 'http://<target>/search/playlists?query=test'.

Impact Analysis

An attacker with valid credentials could enumerate private playlists of other users, exposing sensitive information about their music preferences or personal collections. This could lead to privacy violations or targeted phishing attacks based on discovered playlist names.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by exposing personal data without authorization. It may also conflict with HIPAA if user playlist data contains protected health information, as unauthorized access to such data is prohibited under the regulation.

Mitigation Strategies

Immediately upgrade Black Candy to a version that fixes this issue. If an upgrade is not available, modify the SearchController and Search::PlaylistsController to scope playlist queries to the current user. Change queries to Current.user.playlists.search(params[:query]) to restrict access to only the authenticated user's playlists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart