Approved changes feed: RSS · Atom
cpe:2.3:a:iv_org:invidious:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Iv Org (7f24850b-4c6d-5a18-8bf5-95bd0c350110) |
|---|---|
| Product | Invidious (a4850001-7409-59d0-b989-4fcffdfbb439) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58447 |
vulnerable | 2026-07-29 01:03:16.808801 |
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
MEDIUM (6.5)
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.
Published: 2026-06-30T21:05:53.535Z
Updated: 2026-11-08T14:07:01.575Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.