Read the docs
TI-2026-19458 Aliases CVE-2026-24140

MyTube has Mass Assignment via Settings Management

Priority LOW 24CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-915.

Summary

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed MyTube (franklioxygen): 1.7.79

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
franklioxygenMyTubebefore 1.7.791.7.79Patch availableCNA
  • MyTube Vendorfranklioxygen Affected before 1.7.79 Fixed in 1.7.79 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*before 1.7.78Vulnerablefranklioxygen
  • cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:* Versions before 1.7.78 Vulnerable ·franklioxygen

Remediation

  • Fix · CNA MyTube (franklioxygen) Fixed in 1.7.79

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24140

References

Exploit 1

Patch 1

  • TI-2026-26248 MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration CVSS 4.0HIGH 8.9
  • TI-2026-26114 MyTube has an Improper Access Control that Allows Complete Application Takeover CVSS 4.0HIGH 7.4
  • TI-2026-26286 MyTube has Unauthenticated Account Lockout via Shared Login Attempt State CVSS 4.0HIGH 7.7
  • TI-2026-19200 MyTube has an Authorization Bypass vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-19457 MyTube Allows Unauthorized Database Export by Guest Users CVSS 4.0HIGH 8.7
  • TI-2026-19211 MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences