Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58447Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Invidious from iv-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.

Affected products (as reported)

Vendor	Product	Versions
iv-org	Invidious	0 – through 2.20260626.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Researcher Disclosure technical-description, exploit
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/invidious-cross-user-playlist-video-deletion-via-missing-ownership-check third-party-advisory