CVE-2026-57946

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/iv-org/invidious/commit/c435dc1204970bcca06bcdcfb116c22092be22fd
https://github.com/iv-org/invidious/issues/5775
https://github.com/iv-org/invidious/pull/5776
https://github.com/iv-org/invidious/releases/tag/v2.20260626.0
https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint
https://github.com/iv-org/invidious/issues/5775

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Invidious antes de la versión 2.20260626.0 contiene una vulnerabilidad de control de acceso roto que permite a atacantes no autenticados recuperar el contenido de listas de reproducción privadas al acceder al endpoint de la lista de reproducción del feed RSS sin autenticación. Los atacantes pueden proporcionar un ID de lista de reproducción al endpoint del feed para obtener el contenido completo de la lista de reproducción, la dirección de correo electrónico del propietario y las entradas de vídeo asociadas sin ninguna autenticación.

Information

Published : 2026-06-29 18:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-57946

Mitre link : CVE-2026-57946

CVE.ORG link : CVE-2026-57946

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-57946", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57946", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T18:20:32.000439Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/iv-org/invidious", "vendor": "iv-org", "product": "Invidious", "versions": [{"status": "affected", "version": "0", "lessThan": "2.20260626.0", "versionType": "custom"}], "packageURL": "pkg:github/iv-org/invidious", "defaultStatus": "unaffected"}]}], "published": "2026-06-29T18:16:39.587", "references": [{"url": "https://github.com/iv-org/invidious/commit/c435dc1204970bcca06bcdcfb116c22092be22fd", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/iv-org/invidious/issues/5775", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/iv-org/invidious/pull/5776", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/iv-org/invidious/releases/tag/v2.20260626.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/iv-org/invidious/issues/5775", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication."}, {"lang": "es", "value": "Invidious antes de la versi\u00f3n 2.20260626.0 contiene una vulnerabilidad de control de acceso roto que permite a atacantes no autenticados recuperar el contenido de listas de reproducci\u00f3n privadas al acceder al endpoint de la lista de reproducci\u00f3n del feed RSS sin autenticaci\u00f3n. Los atacantes pueden proporcionar un ID de lista de reproducci\u00f3n al endpoint del feed para obtener el contenido completo de la lista de reproducci\u00f3n, la direcci\u00f3n de correo electr\u00f3nico del propietario y las entradas de v\u00eddeo asociadas sin ninguna autenticaci\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}