Executive brief
Invidious, an open-source alternative YouTube front-end, contains a security flaw that allows logged-in users to delete videos from other people's playlists. By exploiting this, an attacker could permanently remove content from public or unlisted playlists they do not own, leading to data loss and disruption for other users. This issue has been resolved in the latest software updates.
Technical details
A Broken Object Level Authorization (BOLA) vulnerability exists in the `remove_video` action of the `playlist_ajax` endpoint in Invidious. The application validates that the `playlist_id` belongs to the authenticated user but fails to verify that the specific video index (`set_video_id`) also belongs to that playlist. An attacker can discover video index values via the public playlist JSON API and submit them to the deletion endpoint to remove videos from any user's playlist. The vulnerability was addressed by adding ownership validation to the database delete query in commit 77ad416.
Affected products
- iv-org Invidious through 2.20260626.0
Timeline
- 2026-06-15: disclosed: Issue reported on GitHub
- 2026-06-30: patched: Fix merged into master branch
- 2026-06-30: advisory: CVE published to NVD