CVE-2026-62301

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.10.3

Description Backend video access fails to enforce public-only restrictions for the visitor role when loginEnabled is set to true and a visitor password is configured. While a filter exists in VideoContext.tsx, it is only client-side. The roleBasedAuthMiddleware.ts allows all visitor GET requests, and the storageService/videos.ts file executes getVideos() and getVideoById(id) queries without verifying the caller's role or the visibility status. This allows a visitor to enumerate the '/api/videos' endpoint or request '/api/videos/:id' to retrieve records where visibility is 0, exposing titles, sourceUrl, videoPath, subtitle paths, and thumbnailPath. Additionally, the serveMountVideo() path serves mounted video files without visibility checks, enabling unauthenticated media downloads via '/videos/' and '/subtitles/' routes. Single-user deployments with loginEnabled set to false are not affected.

Recommendations Update to version 1.10.3.