Which versions of Invidious are affected by CVE-2026-58447?

Invidious through version 2.20260626.0 allows any authenticated user to permanently delete videos from playlists they don't own, creating uncontrolled data destruction capability; publicly available…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58447?

Yes, a public proof-of-concept exploit is available for CVE-2026-58447. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58447?

Within 24 hours: Identify all systems running Invidious and document current versions; check audit logs for suspicious playlist deletions. Within 7 days: Deploy vendor patch (commit 77ad416 or later) to all production instances. Within 30 days: Audit playlist integrity for unauthorized modifications and implement role-based access controls restricting playlist modifications to owners.

Invidious CVE-2026-58447

Q: What is the CVSS score of CVE-2026-58447?

CVE-2026-58447 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40415 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-30 VulnCheck

GHSA-85cg-fg77-rrm5

Authentication Bypass Invidious

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote, low-complexity action needs an authenticated user (PR:L) and no interaction; impact is unauthorized deletion of others' data (I:H) with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 22:31 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 22:31 vuln.today

Analysis Updated

Jun 30, 2026 - 22:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 22:22 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 22:22 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 22:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 30, 2026 - 22:00 vuln.today

DescriptionCVE.org

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.

AnalysisAI

Cross-user data tampering in Invidious through 2.20260626.0 lets any authenticated user permanently delete videos from playlists they do not own by submitting an arbitrary global video index to the playlist endpoint's remove_video action. The flaw is a broken object level authorization (BOLA) issue where per-video index values are harvested from the public playlist JSON API and replayed without an ownership check. Publicly available exploit code exists and a vendor fix has been released (commit 77ad416); there is no public exploit identified as being used in active attacks.

Technical ContextAI

Invidious is an open-source, self-hostable alternative front-end for YouTube written in Crystal, popular in privacy-focused communities. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the remove_video action on the playlist endpoint trusts a client-supplied global video index to identify which playlist entry to delete, but never validates that the requesting user owns the target playlist. Because the per-video index values are exposed through the public playlist JSON API, an attacker can enumerate legitimate index identifiers for any playlist and reference them directly. The affected product per CPE is cpe:2.3:a:iv-org:invidious:*:*:*:*:*:*:*:* across all versions up to the fixed commit.

RemediationAI

Upgrade to a build that includes the upstream fix commit 77ad41678b45c4f6815940123f1796fc51259f45 (merged via PR https://github.com/iv-org/invidious/pull/5790), which adds the missing ownership validation to the playlist remove_video action; no tagged release version is cited in the input, so operators running from source should pull and rebuild at or after that commit. As Invidious is self-hosted from a git checkout, the practical step is to update the repository to the patched commit and redeploy. If you cannot patch immediately, reduce exposure by restricting account registration on the instance (limit who can authenticate, since exploitation requires a logged-in user) and, on instances that do not need multi-user playlist features, consider disabling public account registration - note this degrades the multi-user functionality of the instance. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/invidious-cross-user-playlist-video-deletion-via-missing-ownership-check) and the GitHub issue (https://github.com/iv-org/invidious/issues/5777) for confirmation of the fix.