Mytube CVE-2026-33735

MyTube versions prior to 1.8.69. Attacker requires low-privilege user credentials to access the /api/settings/import-database endpoint. The endpoint lacks proper authorization checks, allowing authenticated users to upload and replace the SQLite database, fully compromising the application.

This vulnerability presents significant real-world risk despite the absence of a CVSS score. The authentication requirement (low-privilege credentials) reduces attack surface compared to unauthenticated exploits, but does not eliminate it in multi-user self-hosted environments or scenarios where credential compromise occurs. The technical impact is catastrophic: unrestricted database replacement enables attackers to modify application state, inject malicious data, manipulate user accounts, and potentially achieve code execution through stored procedures or by modifying application logic stored in the database. The presence of a GitHub commit fixing the issue indicates the vendor acknowledged and resolved the flaw. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. However, the straightforward nature of the exploit (direct database upload via API) and the critical nature of the impact (full application compromise) warrant immediate patching. Organizations running MyTube versions prior to 1.8.69 should treat this as a high-priority remediation, particularly if the instance is network-accessible or serves multiple users.

An attacker with valid low-privilege credentials (e.g., obtained through credential reuse, phishing, or a compromised account) authenticates to the MyTube instance and crafts a POST request to /api/settings/import-database with a malicious SQLite database file. Due to insufficient authorization checks in the middleware, the request succeeds and replaces the legitimate database. The attacker can then modify stored user accounts to grant themselves administrator privileges, inject malicious data into video metadata to serve phishing links, or modify application state to cause further harm. This scenario requires network access to the MyTube instance and valid authentication credentials, but no exploit code needs to be written beyond standard HTTP tooling.