CVE-2026-57946

LowCVSS 3.7

Published: 29/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

29th percentile - higher than 29% of all known CVEs

Summary

A broken access control vulnerability in Invidious before version 2.20260626.0 allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint. Attackers can supply a playlist ID to obtain the full playlist contents, owner email address, and associated video entries without authentication.

Risk Assessment

The risk involves exposure of private user data, including email addresses and playlist details, which could lead to privacy breaches and potential social engineering attacks.

Recommendation

Immediately update Invidious to version 2.20260626.0 or later, which fixes this vulnerability. Also check for any unauthorized access to playlists.

Other vulnerabilities in Invidious

CVE-2026-58447Medium
A vulnerability in Invidious through version 2.20260626.0 (fixed in commit 77ad416) allows authenticated attackers to delete videos from other users' playlists. It exploits missing ownership validation in the remove_video action of the playlist endpoint.

Original NVD description (English source)

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS