CVE-2026-58447: Invidious Broken Authorization in Playlist Deletion

Technical summary

This is a broken object-level authorization (BOLA) vulnerability in Invidious's playlist management endpoint. The remove_video action fails to validate that the authenticated user owns the playlist before processing deletion requests. Attackers can enumerate video indices from the public playlist JSON API and submit arbitrary indices to the deletion endpoint. The backend processes these requests without confirming ownership, allowing cross-user playlist manipulation. The fix, committed as 77ad416, restores proper ownership checks before permitting deletion operations.

Business impact

User-facing video sharing and curation features become unreliable. Communities relying on shared playlists face griefing and content loss, damaging trust in the platform. For Invidious instance operators, this vulnerability creates support burden, potential data integrity issues, and risk of user churn if playlists are persistently vandalized. Organizations deploying Invidious for internal video libraries face reduced collaboration effectiveness.

Affected systems

Invidious versions through 2.20260626.0 are vulnerable. The fix is available in commit 77ad416 and subsequent builds. This affects all deployments running unpatched versions, regardless of instance size or configuration.

Exploitability

Exploitability is straightforward. An attacker requires only valid authentication credentials and network access to the Invidious instance. No user interaction is needed, no special privileges are required beyond standard login, and the attack is deterministic. Video indices are trivially obtained from public API endpoints. The primary barrier is having a user account; lateral escalation from non-authenticated access is not possible.

Remediation

Upgrade to a version incorporating commit 77ad416 or later. Instance operators should apply this update promptly given the low barrier to exploitation. No interim mitigations are available short of restricting playlist sharing or disabling the playlist feature entirely, neither of which is practical.

Patch guidance

Verify the installed Invidious version and confirm it is later than 2.20260626.0. Check the commit history to ensure commit 77ad416 or a subsequent commit is included in the build. If running from source, pull the latest main branch or checkout the fixed commit directly. If running from a release tarball or container image, check the release date and version string; updates published after July 2026 should include the fix. Consult the official Invidious repository for the exact patched version number.

Detection guidance

Monitor access logs for unusual patterns in the remove_video endpoint (typically /playlist/remove_video or similar). Flag requests originating from authenticated users that target playlists not associated with their account. Implement audit logging on playlist modification actions, recording user ID, target playlist ID, and affected video indices. Look for rapid or sequential deletion requests from a single account across multiple playlists, which may indicate automated exploitation. Review playlist ownership metadata regularly to identify unauthorized deletions after the fact.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), the practical risk justifies prompt attention. The vulnerability requires only authentication and offers no technical complexity, making it exploitable by any user with a login. Permanent data loss is the direct consequence. Organizations operating user-facing Invidious instances should prioritize patching to maintain user trust and service availability. The fix is straightforward and low-risk to deploy.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity attack requiring valid credentials (PR:L), with no user interaction needed (UI:N), affecting only the integrity of playlists (I:H) and causing no confidentiality or availability impact on the system itself (C:N, A:N). This appropriately captures the severity for an authenticated cross-user data manipulation flaw. However, for organizations heavily dependent on playlist functionality, the business impact may warrant treating it as higher priority than the numeric score alone suggests.

Frequently asked questions