UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/HDInnovations/UNIT3D/pull/5622 Yama
• github.com/…ommit/addc2829cefa2d4aad6511bc71311fa5887b9998 Yama
• github.com/HDInnovations/UNIT3D/issues/5621 Üçüncü taraf
• hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor Üçüncü taraf
• vulncheck.com/…-playlist-disclosure-via-playlist-zip-download Üçüncü taraf
• github.com/…app/Http/Controllers/PlaylistZipController.php Diğer
• github.com/HDInnovations/UNIT3D Diğer

Kayıt geçmişi

1. 30 Eki 2026 16:18Yayımlandı

İlgili açıklar

• 8,5 CVE-2026-61708SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
• 4,3 CVE-2026-119664Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
• 4,3 CVE-2026-119663Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create
• 4,2 CVE-2026-119661ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
• 5,4 CVE-2026-119659Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
• 5,0 CVE-2026-119657FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations