UNIT3D through version 9.2.0 contains a missing authorization check in the PlaylistZipController::show method. This flaw allows any authenticated user to download the ZIP file of any private playlist by modifying the playlist identifier. The resulting exception reveals details of private collections, effectively disclosing the membership and contents of those playlists. The vulnerability is a classic case of improper authorization where the system fails to verify that the requesting user owns or is permitted to access the requested resource, as identified by CWE‑639.

All installations of HDInnovations UNIT3D up to and including version 9.2.0 are affected. The issue resides in the controller handling the /playlist-zips/{playlist} endpoint; users with any authenticated session can exploit it.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a relatively low likelihood of widespread exploitation at present. The attack vector requires the attacker to be authenticated, meaning an insider or compromised legitimate account could enumerate sequential playlist identifiers to retrieve ZIP files of other private playlists. Because the data disclosed is sensitive member information, the impact on privacy is significant for affected users.