CVE-2026-57946 describes a broken access control vulnerability in Invidious before version 2.20260626.0. This flaw allows unauthenticated remote attackers to access private playlist data by querying the RSS feed playlist endpoint with a playlist ID. The vulnerability exposes sensitive information such as the full playlist contents, the owner's email address, and the videos linked to the playlist. The CVSS 4.0 base score is 6.3, indicating a medium severity with network attack vector, high attack complexity, and no privileges or user interaction required. No official patch or remediation level has been provided as of the publication date.

The vulnerability enables unauthorized disclosure of private playlist data and owner email addresses without authentication. This could lead to privacy violations and potential further targeted attacks based on exposed user information. However, there is no indication of code execution or system compromise. The attack requires knowledge of a valid playlist ID and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the RSS feed playlist endpoint or implement additional access controls to prevent unauthenticated access to private playlists. Monitor for updates from the iv-org project regarding a security patch.