CVE-2026-58447
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 30, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 30, 2026
Description
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Invidiousiv-org |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- Fix PRissue-tracking
- Fix Commitpatch
- https://www.vulncheck.com/advisories/invidious-cross-user-playlist-video-deletion-via-missing-ownership-checkthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.