Music Assistant closes a privacy gap in its connection for AI clients: a household member could request another member’s private playlist by its identifier. The playlist resource loaded the saved access record without enforcing it.
Mikhail Nevskiy makes the resource enforce the caller’s permission, treating a hidden playlist like a missing one. Marvin Schenkel reviewed the correction. It addresses a specific disclosure alongside the command-access controls reported on October 6.