Threats tagged 'ghsa-68c7-cghq-89pg'

UNIT3D versions through 9.2.0 have a missing authorization vulnerability in the PlaylistZipController::show function. This flaw allows authenticated users to download private playlists belonging to other members by enumerating sequential playlist IDs at the /playlist-zips/{playlist} endpoint. The vulnerability leads to unauthorized disclosure of private collection membership information.