Is CVE-2026-62301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62301 being exploited in the wild.

How severe is CVE-2026-62301?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Franklioxygen MyTube prior to 1.10.3.

How is CVE-2026-62301 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62301?

Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62301: MyTube insufficient role-based access control in video retrieval

CVE-2026-62301 · Severity: info · Published 2026-10-30

MyTube is a self-hosted video downloader and player that supports multiple video platforms. When login is enabled with a visitor password configured, the application fails to enforce visibility restrictions on video metadata and file access for visitor accounts, allowing them to enumerate hidden videos and download restricted media files without proper authorization.

Technologies: Franklioxygen MyTube. Vendors: Franklioxygen.

Quick answers

Is CVE-2026-62301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62301 being exploited in the wild.
How severe is CVE-2026-62301?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Franklioxygen MyTube prior to 1.10.3.
Is there a fix for CVE-2026-62301?: Yes: fixed in 1.10.3. Until then: Do not enable the login feature (keep loginEnabled=false for single-user deployments) until upgrading to version 1.10.3, or configure network-level access controls to restrict visitor access to the backend API and media routes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62301 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62301?: Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.10.3

Do not enable the login feature (keep loginEnabled=false for single-user deployments) until upgrading to version 1.10.3, or configure network-level access controls to restrict visitor access to the backend API and media routes.

Technical details

The vulnerability is an insufficient access control issue affecting the video metadata API and media serving routes. Visitor role restrictions were enforced only client-side in VideoContext.tsx, while the backend roleBasedAuthMiddleware and storageService did not check the caller's role or video visibility settings. A visitor can call GET /api/videos or /api/videos/:id to retrieve hidden videos (visibility=0), leak file paths, and use those paths against unauthenticated /videos/* and /subtitles/* routes to download media without credentials. The issue affects deployments with loginEnabled=true and a visitor password; single-user deployments (loginEnabled=false) are unaffected.

Affected products

franklioxygen MyTube prior to 1.10.3

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.