MyTube, a self-hosted downloader and player for video websites, contains an improper authorization vulnerability (CWE-285) in versions before 1.8.69. Specifically, the /api/settings/import-database endpoint does not properly enforce authorization checks, enabling attackers with limited privileges to replace the application's SQLite database. This flaw extends to other POST routes, potentially allowing full application compromise. The vulnerability has a CVSS 4.0 base score of 7.4, indicating high severity. The issue is fixed in version 1.8.69.

Exploitation of this vulnerability allows an attacker with low-privilege credentials to bypass authorization controls and replace the entire application database. This can lead to a full compromise of the MyTube application, including unauthorized data manipulation and potential control over application behavior. There are no known exploits in the wild at this time.

Upgrade MyTube to version 1.8.69 or later, where the authorization bypass vulnerability has been fixed. No other mitigation steps are indicated by the vendor advisory.