CVE-2026-24140

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24140
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24140.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24140
Aliases
  • GHSA-c938-x24g-fxcx
Published
2026-01-23T23:59:56.045Z
Modified
2026-03-01T02:56:50.482609Z
Severity
  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
MyTube has Mass Assignment via Settings Management
Details

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24140.json",
    "cwe_ids": [
        "CWE-915"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/franklioxygen/mytube

Affected ranges

Type
GIT
Repo
https://github.com/franklioxygen/mytube
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c71e50d2d074948f3588f2418bdf650b996393c3

Affected versions

v1.*
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.19
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.17
v1.4.18
v1.4.19
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.9
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.14
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.9
v1.6.0
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.15
v1.6.16
v1.6.17
v1.6.18
v1.6.19
v1.6.2
v1.6.20
v1.6.21
v1.6.22
v1.6.23
v1.6.24
v1.6.25
v1.6.26
v1.6.27
v1.6.28
v1.6.29
v1.6.3
v1.6.30
v1.6.31
v1.6.32
v1.6.33
v1.6.34
v1.6.35
v1.6.36
v1.6.37
v1.6.38
v1.6.39
v1.6.4
v1.6.40
v1.6.41
v1.6.42
v1.6.43
v1.6.44
v1.6.45
v1.6.46
v1.6.47
v1.6.48
v1.6.49
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.19
v1.7.2
v1.7.20
v1.7.21
v1.7.22
v1.7.23
v1.7.24
v1.7.25
v1.7.26
v1.7.27
v1.7.28
v1.7.29
v1.7.3
v1.7.30
v1.7.31
v1.7.32
v1.7.33
v1.7.34
v1.7.35
v1.7.36
v1.7.37
v1.7.38
v1.7.39
v1.7.4
v1.7.40
v1.7.41
v1.7.42
v1.7.43
v1.7.44
v1.7.45
v1.7.46
v1.7.47
v1.7.48
v1.7.49
v1.7.5
v1.7.50
v1.7.51
v1.7.52
v1.7.53
v1.7.54
v1.7.55
v1.7.56
v1.7.57
v1.7.58
v1.7.59
v1.7.6
v1.7.60
v1.7.61
v1.7.62
v1.7.63
v1.7.64
v1.7.65
v1.7.66
v1.7.67
v1.7.68
v1.7.69
v1.7.7
v1.7.70
v1.7.71
v1.7.72
v1.7.73
v1.7.74
v1.7.75
v1.7.76
v1.7.77
v1.7.78
v1.7.8
v1.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24140.json"