CVE-2026-58447: Authorization Bypass Through User-Controlled Key in iv-org Invidious
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.
AI Analysis
Technical Summary
CVE-2026-58447 is a broken object level authorization vulnerability in Invidious through version 2.20260626.0. Authenticated attackers can exploit this flaw by supplying an arbitrary global video index in the remove_video action of the playlist endpoint to delete videos from playlists they do not own. The per-video index values can be obtained from the public playlist JSON API, enabling attackers to bypass ownership validation and permanently remove videos from other users' playlists. This vulnerability impacts the integrity of user playlists but does not affect confidentiality or availability. The issue was fixed in a commit identified as 77ad416, which is after version 2.20260626.0.
Potential Impact
The vulnerability allows authenticated users to delete videos from other users' playlists without proper authorization checks. This compromises the integrity of playlist data by enabling unauthorized modification. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability exists in a commit after version 2.20260626.0 (commit 77ad416). Users should upgrade to a version that includes this fix to prevent exploitation. Since no official patch version is explicitly stated, users should consult the vendor or project repository for the fixed release. Until patched, restrict authenticated user permissions where possible to limit exposure.
CVE-2026-58447: Authorization Bypass Through User-Controlled Key in iv-org Invidious
Description
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58447 is a broken object level authorization vulnerability in Invidious through version 2.20260626.0. Authenticated attackers can exploit this flaw by supplying an arbitrary global video index in the remove_video action of the playlist endpoint to delete videos from playlists they do not own. The per-video index values can be obtained from the public playlist JSON API, enabling attackers to bypass ownership validation and permanently remove videos from other users' playlists. This vulnerability impacts the integrity of user playlists but does not affect confidentiality or availability. The issue was fixed in a commit identified as 77ad416, which is after version 2.20260626.0.
Potential Impact
The vulnerability allows authenticated users to delete videos from other users' playlists without proper authorization checks. This compromises the integrity of playlist data by enabling unauthorized modification. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability exists in a commit after version 2.20260626.0 (commit 77ad416). Users should upgrade to a version that includes this fix to prevent exploitation. Since no official patch version is explicitly stated, users should consult the vendor or project repository for the fixed release. Until patched, restrict authenticated user permissions where possible to limit exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-30T19:09:07.025Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4436ef27e9c797196d42ac
Added to database: 06/30/2026, 21:36:47 UTC
Last enriched: 07/16/2026, 09:16:23 UTC
Last updated: 08/14/2026, 12:41:11 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.