---
id: CVE-2026-57946
title: Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint
summary: >-
  Invidious before version 2.20260626.0 contains a broken access control
  vulnerability that allows unauthenticated attackers to retrieve private
  playlist contents by accessing the RSS feed playlist endpoint without
  authentication. Attacker…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: iv-org
product: Invidious
affected:
  - Invidious < 2.20260626.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-29T18:20:32.000439Z'
exploitAvailable: true
published: '2026-06-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:37.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57946'
references:
  - url: 'https://github.com/iv-org/invidious/releases/tag/v2.20260626.0'
    label: Invidious 2.20260626.0 Release Notes
  - url: 'https://github.com/iv-org/invidious/issues/5775'
    label: Researcher Disclosure
  - url: 'https://github.com/iv-org/invidious/pull/5776'
    label: Pull Request
  - url: >-
      https://github.com/iv-org/invidious/commit/c435dc1204970bcca06bcdcfb116c22092be22fd
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00352
epssPercentile: 0.29064
ingestedAt: '2026-11-08T14:51:22.319Z'
---

## Overview

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.

## Affected

- `Invidious < 2.20260626.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.