CVE-2026-33735 Details

An authorization bypass vulnerability has been identified in MyTube, a self-hosted video downloader and player, prior to version 1.8.69. The issue resides in the '/api/settings/import-database' endpoint, where low-privilege users can upload and replace the entire SQLite database, leading to a full compromise of the application. This bypass also affects other POST and PATCH routes. The vulnerability arises because the application improperly validates authorization by only checking for certain strings in the URL, allowing unauthorized access to restricted endpoints.

Users are advised to update to MyTube version 1.8.69 or later, where this vulnerability has been fixed.