{"id":"CVE-2026-119596","aliases":[],"cve":{"records":[{"id":"CVE-2026-119596","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T11:46:44.896Z","published":"2026-10-30T13:18:16.431Z","modified":"2026-10-30T13:18:16.431Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T13:18:16.431Z"}],"references":[{"url":"https://github.com/HDInnovations/UNIT3D/pull/5622","tags":["patch","issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/HDInnovations/UNIT3D/commit/addc2829cefa2d4aad6511bc71311fa5887b9998","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/HDInnovations/UNIT3D/issues/5621","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/HDInnovations/UNIT3D/blob/v9.2.0/app/Http/Controllers/PlaylistZipController.php#L33","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/HDInnovations/UNIT3D","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/unit3d-through-9.2.0-private-playlist-disclosure-via-playlist-zip-download","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-639","description":"Authorization Bypass Through User-Controlled Key","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.","score":5.3,"severity":"medium","published":"2026-10-30T13:18:16.431Z","modified":"2026-10-30T13:18:16.431Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HDInnovations","name":"UNIT3D","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.2.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119596"}],"remediation":[],"references":["https://github.com/HDInnovations/UNIT3D/pull/5622","https://github.com/HDInnovations/UNIT3D/commit/addc2829cefa2d4aad6511bc71311fa5887b9998","https://github.com/HDInnovations/UNIT3D/issues/5621","https://github.com/HDInnovations/UNIT3D/blob/v9.2.0/app/Http/Controllers/PlaylistZipController.php#L33","https://hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor","https://github.com/HDInnovations/UNIT3D","https://www.vulncheck.com/advisories/unit3d-through-9.2.0-private-playlist-disclosure-via-playlist-zip-download"],"sources":[{"name":"CVE","id":"CVE-2026-119596","modified":"2026-10-30T13:18:16.431Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119596"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}],"sourceAffected":[],"observedAt":"2026-10-30T14:53:10.633Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:10:34.534Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T15:15:36.832Z","attemptedAt":"2026-10-30T15:15:36.832Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T15:15:35.262Z","attemptedAt":"2026-10-30T15:15:35.262Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T15:15:35.208Z","attemptedAt":"2026-10-30T15:15:35.208Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T15:15:35.896Z","attemptedAt":"2026-10-30T15:15:35.896Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113933","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113933","modified":"Oct 30, 2026, 1:18:16 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T15:15:35.208Z"},{"source":"NVD","id":"CVE-2026-119596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119596","modified":"2026-10-30T14:16:47.593","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T15:15:36.832Z"},{"source":"NVD","id":"CVE-2026-119596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119596","modified":"2026-10-30T14:16:47.593","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T15:15:36.832Z"}],"aiSummary":{"text":"UNIT3D through version 9.2.0 has a missing authorization vulnerability, allowing authenticated users to download other members' private playlists by enumerating sequential playlist IDs. This discloses private collection membership. Authenticated access is required to exploit the weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T15:01:49.639Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119596"}]}}