CVE-2026-62301

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only client-side, roleBasedAuthMiddleware.ts allows all visitor GET requests, and storageService/videos.ts performs getVideos() and getVideoById(id) queries without checking the caller's role or visibility. A visitor can enumerate /api/videos or request /api/videos/:id to retrieve hidden visibility=0 records, exposing titles, sourceUrl values, videoPath values, subtitle paths and thumbnailPath values. The serveMountVideo() path also serves mounted video files without visibility checks. Leaked paths work against unauthenticated /videos/* and /subtitles/* routes, allowing media downloads without credentials. The RSS visitor feed already filters visibility=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only client-side, roleBasedAuthMiddleware.ts allows all visitor GET requests, and storageService/videos.ts performs getVideos() and getVideoById(id) queries without checking the caller's role or visibility. A visitor can enumerate /api/videos or request /api/videos/:id to retrieve hidden visibility=0 records, exposing titles, sourceUrl values, videoPath values, subtitle paths and thumbnailPath values. The serveMountVideo() path also serves mounted video files without visibility checks. Leaked paths work against unauthenticated /videos/* and /subtitles/* routes, allowing media downloads without credentials. The RSS visitor feed already filters visibility=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only client-side, roleBasedAuthMiddleware.ts allows all visitor GET requests, and storageService/videos.ts performs getVideos() and getVideoById(id) queries without checking the caller's role or visibility. A visitor can enumerate /api/videos or request /api/videos/:id to retrieve hidden visibility=0 records, exposing titles, sourceUrl values, videoPath values, subtitle paths and thumbnailPath values. The serveMountVideo() path also serves mounted video files without visibility checks. Leaked paths work against unauthenticated /videos/* and /subtitles/* routes, allowing media downloads without credentials. The RSS visitor feed already filters visibility=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only client-side, roleBasedAuthMiddleware.ts allows all visitor GET requests, and storageService/videos.ts performs getVideos() and getVideoById(id) queries without checking the caller's role or visibility. A visitor can enumerate /api/videos or request /api/videos/:id to retrieve hidden visibility=0 records, exposing titles, sourceUrl values, videoPath values, subtitle paths and thumbnailPath values. The serveMountVideo() path also serves mounted video files without visibility checks. Leaked paths work against unauthenticated /videos/* and /subtitles/* routes, allowing media downloads without credentials. The RSS visitor feed already filters visibility=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.