Live › vulnerability › CVE-2026-119596
UNIT3D through 9.2.0 has a missing authorization check in PlaylistZipController::show, so any logged-in user can download zip files of other members' private playlists. An attacker can walk sequential playlist IDs at /playlist-zips/{playlist} to collect torrent contents and reveal private collection membership.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
UNIT3D instances up to and including 9.2.0 with playlist zip downloads reachable by registered users are exposed. Sites that run a private tracker with no playlist feature, or that have an updated version, can skip it. The sources do not state a fixed version.
No product ranges from the sources yet.
unknown version command, look at the version in the project's config or git tagPlaylistZipController in the app's controllers directoryNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.
This page as .md · .json · in your agent: get_signal("CVE-2026-119596")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.