CVE-2026-97061 describes a missing authorization flaw in Black Candy through version 3.2.1. The vulnerability arises because playlist search queries are not scoped to the authenticated session user. As a result, any authenticated user can query the SearchController or Search::PlaylistsController endpoints with blank or targeted parameters to retrieve playlist names belonging to other users without proper authorization checks.

An attacker with valid authentication can enumerate playlist names of other users on the Black Candy instance. This exposure of playlist metadata could lead to privacy violations or information disclosure. However, the vulnerability does not indicate direct modification or deletion of playlists or other data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints or monitor for unusual search query activity. Avoid sharing authentication credentials with untrusted users.