Filtered by vendor Hdinnovations Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-119596 1 Hdinnovations 1 Unit3d 2026-10-31 4.3 Medium
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.