CVE-2026-57946
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A broken access control vulnerability in Invidious before version 2.20260626.0 allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint. Attackers can supply a playlist ID to obtain the full playlist contents, owner email address, and associated video entries without authentication.
Risk Assessment
The risk involves exposure of private user data, including email addresses and playlist details, which could lead to privacy breaches and potential social engineering attacks.
Recommendation
Immediately update Invidious to version 2.20260626.0 or later, which fixes this vulnerability. Also check for any unauthorized access to playlists.
Original NVD description (English source)
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.