CVE-2026-97061

MEDIUM 4.3

Black Candy through 3.2.1 Information Disclosure via Playlist Search

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

CWE	CWE-862
Vendor	blackcandy-org
Product	black candy
Published	Sep 24, 2026
Last Updated	Sep 24, 2026

Stay Ahead of the Next One

Get instant alerts for blackcandy-org black candy

Be the first to know when new medium vulnerabilities affecting blackcandy-org black candy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

blackcandy-org / Black Candy

0 ≤ 3.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/blackcandy-org/blackcandy/issues/463 github.com: https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9 github.com: https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5 github.com: https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21 github.com: https://github.com/blackcandy-org/blackcandy vulncheck.com: https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-search

Credits

Xumoyunbek Obidjonov