# CVE-2026-62301: MyTube insufficient role-based access control in video retrieval

Source: https://junglewise.ai/threats/cve-2026-62301-mytube-is-a-self-hosted-downloader-and-player-for-several-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-62301 · Severity: info · Published 2026-10-30

MyTube is a self-hosted video downloader and player that supports multiple video platforms. When login is enabled with a visitor password configured, the application fails to enforce visibility restrictions on video metadata and file access for visitor accounts, allowing them to enumerate hidden videos and download restricted media files without proper authorization.

Technologies: [Franklioxygen MyTube](https://junglewise.ai/threats/technologies/mytube). Vendors: [Franklioxygen](https://junglewise.ai/threats/vendors/franklioxygen).

## Quick answers

**Is CVE-2026-62301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62301 being exploited in the wild.

**How severe is CVE-2026-62301?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Franklioxygen MyTube prior to 1.10.3.

**Is there a fix for CVE-2026-62301?** Yes: fixed in 1.10.3. Until then: Do not enable the login feature (keep loginEnabled=false for single-user deployments) until upgrading to version 1.10.3, or configure network-level access controls to restrict visitor access to the backend API and media routes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62301 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62301?** Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.3

Do not enable the login feature (keep loginEnabled=false for single-user deployments) until upgrading to version 1.10.3, or configure network-level access controls to restrict visitor access to the backend API and media routes.

## Technical details

The vulnerability is an insufficient access control issue affecting the video metadata API and media serving routes. Visitor role restrictions were enforced only client-side in VideoContext.tsx, while the backend roleBasedAuthMiddleware and storageService did not check the caller's role or video visibility settings. A visitor can call GET /api/videos or /api/videos/:id to retrieve hidden videos (visibility=0), leak file paths, and use those paths against unauthenticated /videos/* and /subtitles/* routes to download media without credentials. The issue affects deployments with loginEnabled=true and a visitor password; single-user deployments (loginEnabled=false) are unaffected.

## Affected products

- franklioxygen MyTube prior to 1.10.3

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/franklioxygen/MyTube/commit/456d09892b599e78538ef1a795f49b91256c3ca6](https://github.com/franklioxygen/MyTube/commit/456d09892b599e78538ef1a795f49b91256c3ca6)
- [https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456](https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456)

## Related threats

- [MyTube statistics data injection vulnerability](https://junglewise.ai/threats/cve-2026-63434-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube CSRF protection bypass via arbitrary API key header](https://junglewise.ai/threats/cve-2026-63433-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube unauthenticated media access via static routes](https://junglewise.ai/threats/cve-2026-62302-mytube-is-a-self-hosted-downloader-and-player-for-several-video)