---
id: "CVE-2026-62301"
kind: "vulnerability"
aliases: ["CVE-2026-62301"]
title: "MyTube: visitors can read hidden videos and download them without credentials"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "mytube", "package", "self-hosted"]
not_affected_if: ["default-config", "loginenabled-false", "single-user"]
published_at: "2026-10-30T20:17:11+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62301", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# MyTube: visitors can read hidden videos and download them without credentials

MyTube is a self-hosted video downloader and player. Before 1.10.3, a visitor account can list and fetch videos marked hidden, exposing titles, source URLs, file paths, and media that can be downloaded without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MyTube version in the deployed package or image; versions below `1.10.3` are affected.
- Confirm whether `loginEnabled` is `true` and a visitor password is set in the configuration.
- Request `/api/videos` as a visitor and see whether records with `visibility` `0` appear.

## Fix

- Move to version `1.10.3` or later.

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62301

## From the sources

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_