CVE-2026-58447
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 30, 2026
Vendor
unknown
Description
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.