What is the CVSS score of CVE-2026-24139?

CVE-2026-24139 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mytube are affected by CVE-2026-24139?

Organizations using MyTube should be aware of notable risk from CVE-2026-24139, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-24139?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Mytube CVE-2026-24139

MEDIUM

Missing Authorization (CWE-862)

2026-01-24 security-advisories@github.com

Authentication Bypass Information Disclosure Mytube

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:59 vuln.today

Patch released

Feb 02, 2026 - 13:26 nvd

Patch available

CVE Published

Jan 24, 2026 - 00:15 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.

AnalysisAI

MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete application database without proper permission validation. An attacker with guest-level access can retrieve sensitive data they are not authorized to access through the unprotected database export endpoint. A patch is available to address this authorization bypass vulnerability.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Mytube. MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.