EUVD-2026-16512Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the /api/settings/import-database endpoint allows attackers with low-privilege credentials to upload and replace the application's SQLite database entirely, leading to a full compromise of the application. The bypass is relevant for other POST routes as well. Version 1.8.69 fixes the issue.
AnalysisAI
MyTube versions prior to 1.8.69 suffer from an authorization bypass in the /api/settings/import-database endpoint that allows low-privilege authenticated users to upload and replace the application's SQLite database entirely, resulting in complete application compromise. The vulnerability affects self-hosted instances of MyTube and extends to other POST routes using the same flawed authorization mechanism. No public exploit code or active exploitation has been confirmed at time of analysis, but the fix is available in version 1.8.69.
Technical ContextAI
MyTube is a self-hosted downloader and player application built with a backend written in TypeScript (as evidenced by the roleBasedSettingsMiddleware.ts reference). The vulnerability stems from CWE-285 (Improper Authorization), specifically a failure in the roleBasedSettingsMiddleware component to properly enforce role-based access controls on administrative endpoints. The middleware referenced in the GitHub source code repository appears to inadequately validate user privileges before allowing database import operations, allowing authenticated users with lower privilege levels to perform actions reserved for administrators. This authorization bypass pattern affects multiple POST routes beyond just the /api/settings/import-database endpoint, suggesting a systemic issue in how the middleware validates role permissions across the application.
RemediationAI
Upgrade MyTube to version 1.8.69 or later, which includes the authorization bypass fix per the upstream commit at https://github.com/franklioxygen/MyTube/commit/b7bf9b7960958c6c51f85fe50a2fc041a086c466. Until patching is possible, restrict network access to the MyTube instance to trusted users and networks only, implement firewall rules to limit access to the /api/settings/* endpoints, audit database contents for unauthorized modifications or malicious data, rotate credentials for any accounts with access to the MyTube instance, and review application logs for suspicious import-database or POST requests to administrative endpoints. Additionally, review the roleBasedSettingsMiddleware configuration to manually verify that authorization checks are in place on sensitive endpoints.
Mytube versions up to 1.7.71 contains a vulnerability that allows attackers to bypass IP-based rate limiting on general
MyTube self-hosted video downloader has an authorization bypass (CVSS 9.8) that allows unauthenticated access to adminis
MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full ad
MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both a
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignme
MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete ap
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today