MyTube is a self‑hosted downloader and player that, up to version 1.7.78, does not check user authorisation on the database export endpoint, allowing guest users to retrieve the entire application database. This behaviour can expose sensitive data that should remain confidential, thereby compromising the integrity and confidentiality of the system. The flaw is a classic authorisation bypass (CWE-862).

Frank Lioxygen’s MyTube. All released versions 1.7.78 and earlier are vulnerable. Users of these versions should identify whether they are still running a susceptible build and consider upgrading to a safe version if available.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that immediate exploitation is unlikely, yet the lack of a KEV listing means no known active exploits are documented. The likely attack vector is remote, via the application’s web interface, and does not require user credentials beyond guest access. Once the endpoint is triggered, attackers can obtain the full database, which may contain user credentials, configuration details, or other sensitive data. The impact remains confined to systems that still host an affected MyTube instance.