PT-2026-28518 · Mytube · Mytube

Daniel-Grunbergerca · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-33735

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.69

Description MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.8.69, an authorization bypass exists in the /api/settings/import-database API endpoint. This bypass allows attackers with low-privilege credentials to upload and replace the application's SQLite database, resulting in a full compromise of the application. The bypass is also relevant for other POST routes.

Recommendations Versions prior to 1.8.69 should be updated to version 1.8.69 or later.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-33735

GHSA-63CF-662X-CRP2

Affected Products

Mytube

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33735.json · Exploit
• 🔥 https://github.com/franklioxygen/MyTube/security/advisories/GHSA-63cf-662x-crp2 · Exploit
• https://github.com/franklioxygen/MyTube/commit/b7bf9b7960958c6c51f85fe50a2fc041a086c466 · Patch
• https://osv.dev/vulnerability/CVE-2026-33735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33735 · Security Note
• https://github.com/franklioxygen/MyTube/blob/6ade838a46366174e2c030f856340f3856e03132/backend/src/middleware/roleBasedSettingsMiddleware.ts#L116 · Note
• https://twitter.com/CVEarity/status/2037488266510012904 · Twitter Post
• https://twitter.com/CVEnew/status/2037513388574589016 · Twitter Post