{"id":"CVE-2026-58447","title":"Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check","summary":"Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video i…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"iv-org","product":"Invidious","affected":["Invidious <= 2.20260626.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-01T13:21:27.540653Z"},"exploitAvailable":true,"published":"2026-06-30","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:01.575Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58447","references":[{"url":"https://github.com/iv-org/invidious/issues/5777","label":"Researcher Disclosure"},{"url":"https://github.com/iv-org/invidious/pull/5790","label":"Fix PR"},{"url":"https://github.com/iv-org/invidious/commit/77ad41678b45c4f6815940123f1796fc51259f45","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/invidious-cross-user-playlist-video-deletion-via-missing-ownership-check"}],"tags":["cve.org","exploit-available"],"epss":0.00273,"epssPercentile":0.1982,"ingestedAt":"2026-11-08T14:51:22.295Z","slug":"CVE-2026-58447","body":"## Overview\n\nInvidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.\n\n## Affected\n\n- `Invidious <= 2.20260626.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}