CVE-2026-24140— MyTube has Mass Assignment via Settings Management
Quick assessment
Affected
franklioxygen MyTube
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MyTube是Peifan Li个人开发者的一个视频自托管下载器和播放器。 MyTube 1.7.78及之前版本存在安全漏洞，该漏洞源于设置管理功能输入验证不足，可能导致大规模分配攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-24140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MyTube has Mass Assignment via Settings Management
Source: CVE Program / CVE List V5
Vulnerability Description
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Vulnerability Title
MyTube 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MyTube是Peifan Li个人开发者的一个视频自托管下载器和播放器。 MyTube 1.7.78及之前版本存在安全漏洞，该漏洞源于设置管理功能输入验证不足，可能导致大规模分配攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| franklioxygen | MyTube | < 1.7.79 | - |
|
II. Public POCs for CVE-2026-24140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24140
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: MyTube
-
CVE-2026-33935
MyTube has Unauthenticated Account Lockout via Shared Login -
CVE-2026-33890
MyTube has an Unauthenticated Admin Privilege Escalation via -
CVE-2026-33735
MyTube has an Improper Access Control that Allows Complete A -
CVE-2026-24139
MyTube Allows Unauthorized Database Export by Guest Users -
CVE-2026-23848
MyTube has Rate Limiting Bypass via X-Forwarded-For Header S
Same vendor: franklioxygen
-
CVE-2026-33935
MyTube has Unauthenticated Account Lockout via Shared Login -
CVE-2026-33890
MyTube has an Unauthenticated Admin Privilege Escalation via -
CVE-2026-33735
MyTube has an Improper Access Control that Allows Complete A -
CVE-2026-24139
MyTube Allows Unauthorized Database Export by Guest Users -
CVE-2026-23848
MyTube has Rate Limiting Bypass via X-Forwarded-For Header S
Same weakness: CWE-915
-
CVE-2026-105180
Jeebase UserService info updateUser dynamically-determined o -
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion -
CVE-2026-103036
@orpc/json-schema: Prototype injection in smart coercion -
CVE-2026-104908
MISP Decaying Model Import Mass Assignment Allows Cross-Orga -
CVE-2026-103235
MISP Event Delegation Mass Assignment Allows Retargeting Del
V. Comments for CVE-2026-24140
No comments yet