MyTube CVE-2026-62301

Exploitable only when MyTube is deployed in multi-user mode with loginEnabled=true AND a visitor password configured; the attacker must authenticate as the visitor role (PR:L) using that visitor password, then query /api/videos or /api/videos/:id to retrieve visibility=0 records and use the leaked videoPath/subtitle/thumbnail values against the unauthenticated /videos/* and /subtitles/* static routes. Default loginEnabled=false single-user deployments are NOT affected because all callers are owner-equivalent and no visitor role exists. The exposure is limited to confidentiality (metadata disclosure and media/subtitle download); it grants no write, modification, or availability impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 describes a confidentiality-only authorization failure (CWE-862) reachable over the network by a low-privileged visitor without user interaction. Signals mostly agree on a moderate, not critical, priority: not listed in CISA KEV (no confirmed active exploitation), no EPSS probability supplied, and the vuln.today decision label is 'this_week' rather than act_now/emergency. The GitHub advisory publishes concrete curl-based PoC steps, so exploitation is well-documented and trivial once the preconditions are met. The key limiting factor is that this is NOT a default-configuration flaw: it only applies when loginEnabled=true and a visitor password is configured, so default single-user (loginEnabled=false) deployments are entirely unaffected. Impact is bounded to disclosure (hidden video metadata and the actual media/subtitle files), with no integrity or availability impact. Net assessment: a real, credible issue for the subset of multi-user deployments, but its real-world blast radius is constrained by the non-default prerequisite and the confidentiality-only impact - consistent with the 'this_week' priority rather than an emergency.

On a shared MyTube instance running in multi-user mode (loginEnabled=true) with a visitor password, an attacker who knows or is given the visitor password authenticates as a visitor and requests /api/videos, which returns every video including hidden visibility=0 records with their videoPath, sourceUrl, subtitle and thumbnail paths. The attacker then fetches those paths from the unauthenticated /videos/* and /subtitles/* static routes to download the hidden media directly. The GitHub advisory includes step-by-step curl commands demonstrating this flow.