PT-2026-28518 · Mytube · Mytube

Daniel-Grunbergerca · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-33735

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.69

Description MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.8.69, an authorization bypass exists in the /api/settings/import-database API endpoint. This bypass allows attackers with low-privilege credentials to upload and replace the application's SQLite database, resulting in a full compromise of the application. The bypass is also relevant for other POST routes.

Recommendations Versions prior to 1.8.69 should be updated to version 1.8.69 or later.

Exploit

Correção

IDOR

Improper Authorization

Enumeração de Fraquezas

CWE-639

CWE-285

Identificadores relacionados

CVE-2026-33735

GHSA-63CF-662X-CRP2

Produtos afetados

Mytube

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33735.json · Exploit
• 🔥 https://github.com/franklioxygen/MyTube/security/advisories/GHSA-63cf-662x-crp2 · Exploit
• https://github.com/franklioxygen/MyTube/blob/6ade838a46366174e2c030f856340f3856e03132/backend/src/middleware/roleBasedSettingsMiddleware.ts#L116 · Nota
• https://github.com/franklioxygen/MyTube/commit/b7bf9b7960958c6c51f85fe50a2fc041a086c466 · Correção
• https://twitter.com/CVEarity/status/2037488266510012904 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33735 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037513388574589016 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33735 · Nota de Segurança