PT-2026-4537 · Mytube · Mytube

P1Ngul1N0 · Publicado 2026-01-23 · Atualizado 2026-02-02 · CVE-2026-24139

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MyTube versions 1.7.78 and below

Description The MyTube application does not properly protect against authorization bypass, potentially allowing guest users to download the complete application database. The application does not validate user permissions correctly on the database export endpoint, which allows low-privileged users to access sensitive data they are not authorized to view.

Recommendations Update MyTube to a version higher than 1.7.78.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-24139

GHSA-HHC3-8Q8C-89Q7

Produtos afetados

Mytube

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24139.json · Exploit
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-hhc3-8q8c-89q7 · Nota
• https://github.com/franklioxygen/MyTube/commit/e271775e27d51b26e54731b7b874447f47a1f280 · Correção
• https://t.me/cveNotify/150554 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24139 · Nota de Segurança
• https://t.me/CVEtracker/42890 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24139 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014995819313979701 · Publicação no Twitter
• https://t.me/cveNotify/149770 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014916857166254564 · Publicação no Twitter