{"id":"CVE-2026-57946","title":"Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint","summary":"Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attacker…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"iv-org","product":"Invidious","affected":["Invidious < 2.20260626.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-29T18:20:32.000439Z"},"exploitAvailable":true,"published":"2026-06-29","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:06:37.616Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-57946","references":[{"url":"https://github.com/iv-org/invidious/releases/tag/v2.20260626.0","label":"Invidious 2.20260626.0 Release Notes"},{"url":"https://github.com/iv-org/invidious/issues/5775","label":"Researcher Disclosure"},{"url":"https://github.com/iv-org/invidious/pull/5776","label":"Pull Request"},{"url":"https://github.com/iv-org/invidious/commit/c435dc1204970bcca06bcdcfb116c22092be22fd","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint"}],"tags":["cve.org","exploit-available"],"epss":0.00352,"epssPercentile":0.29064,"ingestedAt":"2026-11-08T14:51:22.319Z","slug":"CVE-2026-57946","body":"## Overview\n\nInvidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.\n\n## Affected\n\n- `Invidious < 2.20260626.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}