SZB-0196c22477
UNIT3D missing authorization lets users download others' private playlists (EUVD-2026-113933)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- HDInnovations
- Product
- UNIT3D
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a missing authorization vulnerability in UNIT3D through 9.2.0, scored 5.3/10 (CVSS v3.1). According to the entry, authenticated users can enumerate playlist IDs to download other members' private playlists.
If you use HDInnovations
Update UNIT3D to a version later than 9.2.0 once a fix is released
Add an ownership check to PlaylistZipController::show as an interim fix
Review logs for sequential playlist download requests
What the sources say 1
· Mastodon: “UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists.” Source