Anyone can add to collaborative playlist

[Abeiterboy]

Plan

Premium/Family

Country

US

Device

iPhone XS, Lenovo T480, Samsung S20, iPhone 12, and Macbook 13"

Operating System

iOS 14, MacOS 10.10-11, Windows 10, Android

My Question or Issue

It seems that anyone can add to any collaborative playlist. This allows the collaborative playlist feature to be abused where any user can delete or add songs to any public playlist. I confirmed with multiple playlists and multiple users across multiple systems. The user doesn't even have to be following the playlist in order to delete or add songs thanks to the "add songs" suggestions function.

I see that there is a feature request in Ideas that would solve this but I believe this goes beyond features and should be considered a bug. 

If someone had created a playlist to share with teachers for classroom music, a malicious user across the world could add songs containing profanity. Or a playlist intended to be shared with friends themed around punk music could be wiped out and filled with classic rock by any random user that came across the playlist in a search. 

[Elena]

Hi there @Abeiterboy,

Thanks for reaching out to the Community!

When you create a Collaborative playlist, only the people you share the link to can edit it, as long as the playlist is set to ''Secret''. You can find the steps to make a playlist Secret here.

By doing so, the playlist won't be visible and editable by anyone else but you and the people you've shared it with. Keep in mind that everyone who has the link will be able to edit it, so we recommend avoiding sharing it in public.

Let us know if you don't see the Make Secret option or if it doesn't work properly and we'll see what we can suggest.

We'll be on the lookout 🙂

[iamcontemporary]

Hi, 

I’m running into the same issue (random people adding songs) but when I go to “make private” (there is no mention of ‘secret’ anywhere) it tells me that only I will have access to the playlist. That defeats the purpose of having a collaborative playlist. 
Neither I or the person I’ve shared it with have shared the link with anyone. 
Any suggestions? 

[Eni]

Hi there @iamcontemporary, 

Thanks for reaching out about this here in the Community. 

Currently, if you'd like to make a playlist that will not show up on your profile, but that you'd like to share with other people you can use the option ''Remove from profile''. Also, on the mobile app we offer the option to ''Make private'' which means that only you will be able to see the list. For more info, we suggest that you check this article. 

On another note, it seems also that some other users feel the way you do and posted this idea. You can add your support there by up-voting the idea. We'll inform on any developments there, as soon  as there are any. So make sure to subscribe, if you haven't already.

If you need a hand with anything else, the Community is here for you.