CVE-2026-119596

    Dashboard / Vulnerabilities / CVE-2026-119596

    CVE-2026-119596

    Published: 30 Oct 2026Last Modified: 5 Nov 2026

    Summary: UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

    Details: UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119596.json, https://hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor, https://nvd.nist.gov/vuln/detail/CVE-2026-119596, https://www.vulncheck.com/advisories/unit3d-through-9.2.0-private-playlist-disclosure-via-playlist-zip-download, https://github.com/HDInnovations/UNIT3D/issues/5621, https://github.com/HDInnovations/UNIT3D/commit/addc2829cefa2d4aad6511bc71311fa5887b9998, https://github.com/HDInnovations/UNIT3D/pull/5622, https://github.com/HDInnovations/UNIT3D, https://github.com/HDInnovations/UNIT3D/blob/v9.2.0/app/Http/Controllers/PlaylistZipController.php#L33

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e800ba7c2d3ca3df5926afddcec92afcd40d8bda
    Fixed -addc2829cefa2d4aad6511bc71311fa5887b9998

    Affected versions

    v9.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119596 | CVE-DB