{"id":"CVE-2026-62301","kind":"vulnerability","aliases":["CVE-2026-62301"],"related":[],"title":"MyTube: visitors can read hidden videos and download them without credentials","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.","summary":"MyTube is a self-hosted video downloader and player. Before 1.10.3, a visitor account can list and fetch videos marked hidden, exposing titles, source URLs, file paths, and media that can be downloaded without logging in.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","mytube","package","self-hosted"],"not_affected_if":["default-config","loginenabled-false","single-user"],"how_to_check":"- Check the MyTube version in the deployed package or image; versions below `1.10.3` are affected.\n- Confirm whether `loginEnabled` is `true` and a visitor password is set in the configuration.\n- Request `/api/videos` as a visitor and see whether records with `visibility` `0` appear.","fix":"- Move to version `1.10.3` or later.","status":"open","published_at":"2026-10-30T20:17:11+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:35+00:00","updated_at":"2026-10-30T20:26:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to version `1.10.3` or later.","reach":"network","title":"MyTube: visitors can read hidden videos and download them without credentials","impact":"medium","summary":"MyTube is a self-hosted video downloader and player. Before 1.10.3, a visitor account can list and fetch videos marked hidden, exposing titles, source URLs, file paths, and media that can be downloaded without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mytube","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"hidden videos and file paths leak; media downloads without credentials","analyst_note":"","how_to_check":"- Check the MyTube version in the deployed package or image; versions below `1.10.3` are affected.\n- Confirm whether `loginEnabled` is `true` and a visitor password is set in the configuration.\n- Request `/api/videos` as a visitor and see whether records with `visibility` `0` appear.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","loginEnabled-false","single-user"],"who_is_affected":"Deployments running MyTube before 1.10.3 with login enabled and a visitor password configured are exposed, since the visitor role can reach hidden video records through the API and media routes. Single-user deployments with login disabled are not affected by this role-boundary issue because every caller is owner-equivalent.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4440,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62301':14A,17A '/api/videos':137C,140C '/subtitles':177C '/videos':175C '0':146C '1':191C '1.10.3':35B,76C,228C 'access':79C 'account':38B 'affect':197C 'allow':112C,179C 'alreadi':188C 'also':162C 'backend':77C 'boundari':213C 'caller':128C,217C 'check':126C,169C 'client':109C 'client-sid':108C 'configur':100C 'content':192C 'credenti':11A,183C 'cve':12A,15A 'default':200C 'deploy':206C 'docker':18B 'download':8A,31B,57B,66C,181C 'enforc':82C 'enumer':136C 'equival':221C 'expos':46B,148C 'fals':202C 'feed':187C 'fetch':42B 'file':50B,166C 'filter':103C,189C 'fix':225C 'frontend':102C 'get':115C 'getvideo':120C 'getvideobyid':122C 'hidden':5A,45B,144C 'host':23B,29B,65C 'id':123C,141C 'intend':87C 'issu':214C,223C 'leak':170C 'list':40B 'log':59B 'loginen':93C,201C 'mark':44B 'media':53B,180C 'mount':164C 'mytub':1A,19B,24B,60C 'owner':220C 'owner-equival':219C 'packag':20B 'password':98C 'path':51B,155C,161C,171C,199C 'perform':119C 'player':33B,68C 'prior':73C 'public':89C 'public-on':88C 'queri':124C,198C 'read':4A 'record':147C 'request':116C,139C 'restrict':91C 'retriev':143C 'role':85C,130C,212C 'role-boundari':211C 'rolebasedauthmiddleware.ts':111C 'rout':178C 'rss':185C 'self':22B,28B,64C 'self-host':21B,27B,63C 'serv':163C 'servemountvideo':160C 'sever':70C 'side':110C 'singl':204C 'single-us':203C 'sourc':48B 'sourceurl':150C 'storageservice/videos.ts':118C 'subtitl':154C 'thumbnailpath':157C 'titl':47B,149C 'true':94C 'unaffect':208C 'unauthent':174C 'url':49B 'user':205C 'valu':151C,153C,158C 'version':75C,227C 'video':6A,30B,43B,71C,78C,165C 'videocontext.tsx':105C 'videopath':152C 'visibl':132C,145C,168C,190C 'visitor':2A,37B,84C,97C,114C,134C,186C 'websit':72C 'without':10A,58B,125C,167C,182C 'work':172C","nicknames":[],"mitigations":[],"who_affected":"Deployments running MyTube before 1.10.3 with login enabled and a visitor password configured are exposed, since the visitor role can reach hidden video records through the API and media routes. Single-user deployments with login disabled are not affected by this role-boundary issue because every caller is owner-equivalent.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62301","severity":null,"published_at":"2026-10-30T20:17:11+00:00","modified_at":"2026-10-30T20:17:11+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}