Vulnerability · Published Jan 23, 2026 · Assigned by GitHub_M

CVE-2026-24139MyTube Allows Unauthorized Database Export by Guest Users

High 8.7

In plain English

A high-severity missing authorization in MyTube from franklioxygen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.

Affected products (as reported)

Vendor	Product	Versions
franklioxygen	MyTube	< 1.7.79

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/franklioxygen/MyTube/security/advisories/GHSA-hhc3-8q8c-89q7 x_refsource_CONFIRM
https://github.com/franklioxygen/MyTube/commit/e271775e27d51b26e54731b7b874447f47a1f280 x_refsource_MISC