CVE-2026-62301

HighCVSS 7.1

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

35th percentile - higher than 35% of all known CVEs

Summary

In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.

Risk Assessment

A visitor can expose titles, source URLs, and paths to video, subtitle, and thumbnail files, then download media without authentication. This breaks the role boundary and the confidentiality of content marked as hidden.

Recommendation

Update MyTube to version 1.10.3 or later. If updating is not possible, consider disabling visitor accounts or restricting network access to the API and the /videos/* and /subtitles/* routes.

Other vulnerabilities in MyTube

CVE-2026-62302High
MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.

Original NVD description (English source)

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS