---
id: CVE-2026-119596
title: UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download
summary: >-
  UNIT3D through 9.2.0 contains a missing authorization vulnerability in
  PlaylistZipController::show that allows authenticated users to download other
  members' private playlists. Attackers can enumerate sequential playlist ids at
  the /play…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: HDInnovations
product: UNIT3D
affected:
  - UNIT3D <= 9.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:27:18.835121Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:27:31.235Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119596'
references:
  - url: 'https://github.com/HDInnovations/UNIT3D/pull/5622'
  - url: >-
      https://github.com/HDInnovations/UNIT3D/commit/addc2829cefa2d4aad6511bc71311fa5887b9998
  - url: 'https://github.com/HDInnovations/UNIT3D/issues/5621'
  - url: >-
      https://github.com/HDInnovations/UNIT3D/blob/v9.2.0/app/Http/Controllers/PlaylistZipController.php#L33
  - url: 'https://hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor'
  - url: 'https://github.com/HDInnovations/UNIT3D'
  - url: >-
      https://www.vulncheck.com/advisories/unit3d-through-9.2.0-private-playlist-disclosure-via-playlist-zip-download
    label: >-
      VulnCheck Advisory: UNIT3D through 9.2.0 Private Playlist Disclosure via
      Playlist Zip Download
tags:
  - cve.org
epss: 0.00277
epssPercentile: 0.20262
ingestedAt: '2026-11-05T21:36:00.647Z'
---

## Overview

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

## Affected

- `UNIT3D <= 9.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.