The vulnerability is a broken object‑level authorization flaw that allows an authenticated user to delete videos from another user’s playlist. By providing an arbitrary global video index to the playlist endpoint’s remove_video action, an attacker can permanently remove entries from playlists they do not own. The impact is loss of content available to the playlist owner and potential disruption of user experience, with no direct data disclosure or code execution. The weakness is classified as an authorization bypass (CWE‑639).

The affected product is Invidious for the iv‑org vendor, versions up to and including 2.20260626.0. The patch addressing the issue was introduced in commit 77ad416. No other vendors or products are listed as affected.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The exploitation requires a valid user account; attackers can obtain the necessary video indices from the public playlist JSON API and submit them directly to the deletion endpoint. No additional prerequisites are noted, so an authenticated user can readily exploit the missing ownership check. The attack would result in unilateral removal of media from other users’ playlists.