Black Candy through 3.2.1 Information Disclosure via Playlist Search

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97061 · Microsoft / collected KEV context

cve-program · CVE-2026-97061

• https://github.com/blackcandy-org/blackcandy/issues/463
• https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9
• https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5
• https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21
• https://github.com/blackcandy-org/blackcandy
• https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-search

No related operational record is retained in the current change model.