Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62301— MyTube: Visitor Can Access Hidden Video Metadata and Content

Quick assessment

Affected
franklioxygen MyTube
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MyTube 是一个支持多个视频网站的自托管下载器与播放器。在 1.10.3 版本之前，当启用登录功能（ ）并配置了访客密码时，后端视频访问逻辑未能正确强制执行“仅公开”的访客角色限制。具体而言， 中的前端过滤机制仅运行于客户端； 允许所有访客发起的 GET 请求；而 在执行 和 查询时，未对调用者的角色或资源的 属性进行校验。 因此，访客可通过枚举 接口或请求 来检索 的隐藏记录，从而泄露视频标题、 、 、字幕路径及缩略图路径等敏感信息。此外， 路径在提供挂载视频文件时也未进行 检查。泄露的路径信息可被用于未认证

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
franklioxygen MyTube < 1.10.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62301

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MyTube: Visitor Can Access Hidden Video Metadata and Content
Source: CVE Program / CVE List V5
Vulnerability Description
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
franklioxygen MyTube < 1.10.3 -

II. Public POCs for CVE-2026-62301

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62301

请登录查看更多情报信息。

Other References for CVE-2026-62301 (6)

IV. Related Vulnerabilities

Same product: MyTube
Same vendor: franklioxygen
Same weakness: CWE-862