From 79cc9765cf343e30515b6d4609cb741aad4a017d Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Wed, 22 Apr 2026 16:29:47 -0500
Subject: [PATCH 1/2] Update collection endpoints to check user library access

---
 server/controllers/CollectionController.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/server/controllers/CollectionController.js b/server/controllers/CollectionController.js
index 1476b0f81..bb00ea346 100644
--- a/server/controllers/CollectionController.js
+++ b/server/controllers/CollectionController.js
@@ -41,6 +41,10 @@ class CollectionController {
     if (reqBody.description && typeof reqBody.description !== 'string') {
       return res.status(400).send('Invalid collection description')
     }
+    if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
+      Logger.warn(`[CollectionController] User "${req.user.username}" attempted to create collection in inaccessible library ${reqBody.libraryId}`)
+      return res.sendStatus(403)
+    }
     const libraryItemIds = (reqBody.books || []).filter((b) => !!b && typeof b == 'string')
     if (!libraryItemIds.length) {
       return res.status(400).send('Invalid collection data. No books')
@@ -109,8 +113,9 @@ class CollectionController {
    */
   async findAll(req, res) {
     const collectionsExpanded = await Database.collectionModel.getOldCollectionsJsonExpanded(req.user)
+    const accessibleCollections = collectionsExpanded.filter((c) => req.user.checkCanAccessLibrary(c.libraryId))
     res.json({
-      collections: collectionsExpanded
+      collections: accessibleCollections
     })
   }
 
@@ -431,6 +436,10 @@ class CollectionController {
       if (!collection) {
         return res.status(404).send('Collection not found')
       }
+      if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
+        Logger.warn(`[CollectionController] User "${req.user.username}" attempted to access collection ${collection.id} in inaccessible library ${collection.libraryId}`)
+        return res.status(404).send('Collection not found')
+      }
       req.collection = collection
     }
 

From 9ab35ef418090fa5b8f9b36f366dbea1c078a660 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Wed, 22 Apr 2026 16:42:58 -0500
Subject: [PATCH 2/2] Update playlist endpoints to check user still has library
 access

---
 server/controllers/PlaylistController.js | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/server/controllers/PlaylistController.js b/server/controllers/PlaylistController.js
index bc1a7a455..6ad7cff9e 100644
--- a/server/controllers/PlaylistController.js
+++ b/server/controllers/PlaylistController.js
@@ -37,6 +37,10 @@ class PlaylistController {
     if (reqBody.description && typeof reqBody.description !== 'string') {
       return res.status(400).send('Invalid playlist description')
     }
+    if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
+      Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist in inaccessible library ${reqBody.libraryId}`)
+      return res.sendStatus(403)
+    }
     const items = reqBody.items || []
     const isPodcast = items.some((i) => i.episodeId)
     const libraryItemIds = new Set()
@@ -133,8 +137,9 @@ class PlaylistController {
    */
   async findAllForUser(req, res) {
     const playlistsForUser = await Database.playlistModel.getOldPlaylistsForUserAndLibrary(req.user.id)
+    const accessiblePlaylists = playlistsForUser.filter((p) => req.user.checkCanAccessLibrary(p.libraryId))
     res.json({
-      playlists: playlistsForUser
+      playlists: accessiblePlaylists
     })
   }
 
@@ -508,6 +513,10 @@ class PlaylistController {
     if (!collection) {
       return res.status(404).send('Collection not found')
     }
+    if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
+      Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist from collection ${collection.id} in inaccessible library ${collection.libraryId}`)
+      return res.status(404).send('Collection not found')
+    }
     // Expand collection to get library items
     const collectionExpanded = await collection.getOldJsonExpanded(req.user)
     if (!collectionExpanded) {
@@ -573,6 +582,10 @@ class PlaylistController {
         Logger.warn(`[PlaylistController] Playlist ${req.params.id} requested by user ${req.user.id} that is not the owner`)
         return res.sendStatus(403)
       }
+      if (!req.user.checkCanAccessLibrary(playlist.libraryId)) {
+        Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to access playlist ${playlist.id} in inaccessible library ${playlist.libraryId}`)
+        return res.status(404).send('Playlist not found')
+      }
       req.playlist = playlist
     }