Black Candy versions through 3.2.1 lack authorization filtering on playlist search endpoints, allowing an authenticated user to retrieve playlist names belonging to other users. This leads to information disclosure of playlist metadata without consent. The weakness is a missing authorization check (CWE-862).

Affected systems include the Black Candy application from blackcandy-org. Versions up to and including 3.2.1 are impacted. No later versions are listed as safe.

The CVSS base score of 5.3 represents moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Attackers need a valid authenticated session; the likely attack vector involves sending search queries to the SearchController or Search::PlaylistsController endpoints with blank or crafted parameters to enumerate all playlists. The vulnerability can therefore be abused in environments where users have access to more than one account, facilitating insight into other users' playlists.