CVE-2026-97061
Black Candy through 3.2.1 Information Disclosure via Playlist Search
blackcandy-org Black Candy
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.
Text from CVE List
Affected versions 1
- Black Candyaffected: all versions through 3.2.1CVE List
References 6
- vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-searchAdvisoryvia CVE List
- github.com/blackcandy-org/blackcandy/issues/463Referencevia CVE List
- github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9Referencevia CVE List
- github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5Referencevia CVE List
- github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21Referencevia CVE List
- github.com/blackcandy-org/blackcandyReferencevia CVE List