PT-2026-4537 · Mytube · Mytube

P1Ngul1N0 · Published 2026-01-23 · Updated 2026-02-02 · CVE-2026-24139

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MyTube versions 1.7.78 and below

Description The MyTube application does not properly protect against authorization bypass, potentially allowing guest users to download the complete application database. The application does not validate user permissions correctly on the database export endpoint, which allows low-privileged users to access sensitive data they are not authorized to view.

Recommendations Update MyTube to a version higher than 1.7.78.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-24139

GHSA-HHC3-8Q8C-89Q7

Affected Products

Mytube

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24139.json · Exploit
• https://github.com/franklioxygen/MyTube/commit/e271775e27d51b26e54731b7b874447f47a1f280 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24139 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24139 · Vendor Advisory
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-hhc3-8q8c-89q7 · Note
• https://t.me/cveNotify/150554 · Telegram Post
• https://t.me/CVEtracker/42890 · Telegram Post
• https://twitter.com/CVEnew/status/2014995819313979701 · Twitter Post
• https://t.me/cveNotify/149770 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014916857166254564 · Twitter Post