EUVD-2026-114368 reports access control flaw in MyTube before 1.10.3
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MyTube
- Product
- MyTube
- First seen
Summary
The EUVD listing says that before version 1.10.3, MyTube's backend video access does not enforce the visitor role's public-only restriction when loginEnabled=true and a visitor password is set. It assigns a CVSS v3.1 score of 7.1.
If you use MyTube
Upgrade MyTube to version 1.10.3 or later
Review which videos are reachable by visitor accounts
Rotate the visitor password if the instance was exposed before upgrading
Audit access logs for unauthenticated API requests
Restrict network exposure of MyTube until patched
What the sources say 2
· Mastodon: “Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are ...” Source
· Mastodon: “Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured....” Source