CVE-2026-24139
MEDIUMMyTube <1.7.78 - Auth Bypass
Title source: llmDescription
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.
Exploits (1)
github
WORKING POC
1 stars
by p1ngul1n0 · poc
https://github.com/p1ngul1n0/security-research/tree/main/CVE-2026-24139.md
Scores
CVSS v3
6.5
EPSS
0.0001
EPSS Percentile
1.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-862
Status
published
Products (1)
franklioxygen/mytube
< 1.7.78
Published
Jan 24, 2026
Tracked Since
Feb 18, 2026