CVE-2026-58447

MediumCVSS 6.5

Published: 30/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability in Invidious through version 2.20260626.0 (fixed in commit 77ad416) allows authenticated attackers to delete videos from other users' playlists. It exploits missing ownership validation in the remove_video action of the playlist endpoint.

Risk Assessment

An attacker can permanently remove videos from other users' playlists, causing data loss and service disruption. The vulnerability is easy to exploit as attackers can obtain video indices from the public playlist JSON API.

Recommendation

Immediately update Invidious to a version containing commit 77ad416 or later. If updating is not possible, restrict access to the playlist endpoint to trusted users only.

Other vulnerabilities in Invidious

CVE-2026-57946Low
A broken access control vulnerability in Invidious before version 2.20260626.0 allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint. Attackers can supply a playlist ID to obtain the full playlist contents, owner email address, and associated video entries without authentication.

Original NVD description (English source)

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS