CVE-2026-57946: Broken Access Control in Invidious RSS Feed Exposes Private Playlists

Technical summary

CVE-2026-57946 is a broken access control vulnerability (CWE-862) in the RSS feed endpoint of Invidious. The endpoint fails to enforce authentication checks before serving playlist metadata and contents. An attacker can craft a request to the feed endpoint with a target playlist ID and receive the full playlist object, including video entries and the playlist owner's email address, without presenting valid credentials. The vulnerability affects all versions prior to 2.20260626.0.

Business impact

For organizations or communities running Invidious instances, this vulnerability exposes the private playlists of their users to unauthorized disclosure. Email addresses of playlist owners become discoverable, creating both a privacy breach and a potential vector for social engineering or targeted harassment. Users who believe their playlists are private may have their viewing preferences, interests, or curated content exposed. The reputational impact is moderate if a public instance is compromised.

Affected systems

Invidious versions prior to 2.20260626.0 are affected. The vulnerability is present in the RSS feed endpoint specifically. Any public or private Invidious deployment using an unpatched version is at risk if the RSS feed functionality is enabled.

Exploitability

The vulnerability is moderately easy to exploit. An attacker needs only a valid playlist ID—which may be guessable, leaked, or discovered through enumeration—to retrieve private contents. No account creation, credential theft, or interaction is required. However, the CVSS score of 3.7 (LOW) reflects the fact that this is a confidentiality issue affecting only a single user's data per request and carries no integrity or availability impact. Attack complexity is rated as high, suggesting that some barriers exist, though the practical barrier is minimal for a determined attacker.

Remediation

Upgrade Invidious to version 2.20260626.0 or later. This patched version implements proper authentication checks on the RSS feed playlist endpoint. Organizations running Invidious should prioritize this update if private playlists are in use on their instance. If an immediate patch is not feasible, consider disabling RSS feed access temporarily or restricting it to authenticated users only via reverse proxy configuration.

Patch guidance

Verify the installed version of Invidious and confirm it is 2.20260626.0 or later. Consult the Invidious project repository or official release notes for upgrade instructions. After patching, verify that the RSS feed endpoint now requires authentication for private playlists or returns an error when accessed without credentials. Test with a known private playlist ID to confirm the fix is in place.

Detection guidance

Monitor access logs for the RSS feed endpoint (typically `/feed/playlist/[playlist_id]`). Identify any requests from unauthenticated sessions or IP addresses that are not part of your expected user base. Look for repeated requests with different playlist IDs, which may indicate enumeration attempts. If Invidious logging is enabled, check for successful retrieval of private playlist data by anonymous users. Implement network-level monitoring to detect outbound email address exfiltration patterns if a breach is suspected.

Why prioritize this

Although the CVSS score is low, the vulnerability warrants timely patching because it directly undermines user privacy expectations around private playlists. The fix is non-disruptive and is included in a released version. Organizations running multi-user Invidious instances should prioritize this update within their regular patch cycle, especially if users depend on playlists for sensitive or personal content curation.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects a low-severity confidentiality impact with no integrity or availability loss. The attack vector is network-based, requires no privileges, and no user interaction. Attack complexity is rated high, which tempers the score somewhat. However, the practical exploitability is straightforward once a playlist ID is known, making the high attack complexity rating conservative. The low score should not be interpreted as zero risk; rather, it indicates a focused impact on confidentiality.

Frequently asked questions