Live › vulnerability › CVE-2026-62301
MyTube is a self-hosted video downloader and player. Before 1.10.3, a visitor account can list and fetch videos marked hidden, exposing titles, source URLs, file paths, and media that can be downloaded without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Deployments running MyTube before 1.10.3 with login enabled and a visitor password configured are exposed, since the visitor role can reach hidden video records through the API and media routes. Single-user deployments with login disabled are not affected by this role-boundary issue because every caller is owner-equivalent.
No product ranges from the sources yet.
1.10.3 are affected.loginEnabled is true and a visitor password is set in the configuration./api/videos as a visitor and see whether records with visibility 0 appear.1.10.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only client-side, roleBasedAuthMiddleware.ts allows all visitor GET requests, and storageService/videos.ts performs getVideos() and getVideoById(id) queries without checking the caller's role or visibility. A visitor can enumerate /api/videos or request /api/videos/:id to retrieve hidden visibility=0 records, exposing titles, sourceUrl values, videoPath values, subtitle paths and thumbnailPath values. The serveMountVideo() path also serves mounted video files without visibility checks. Leaked paths work against unauthenticated /videos/* and /subtitles/* routes, allowing media downloads without credentials. The RSS visitor feed already filters visibility=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-62301")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.