CVE-2026-24140

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24140", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.475Z", "datePublished": "2026-01-23T23:59:56.045Z", "dateUpdated": "2026-01-26T16:17:58.728Z"}, "containers": {"cna": {"title": "MyTube has Mass Assignment via Settings Management", "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx"}, {"name": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6", "tags": ["x_refsource_MISC"], "url": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6"}], "affected": [{"vendor": "franklioxygen", "product": "MyTube", "versions": [{"version": "< 1.7.79", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:59:56.045Z"}, "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78."}], "source": {"advisory": "GHSA-c938-x24g-fxcx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T16:14:35.666469Z", "id": "CVE-2026-24140", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T16:17:58.728Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24140", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.475Z", "datePublished": "2026-01-23T23:59:56.045Z", "dateUpdated": "2026-01-26T16:17:58.728Z"}, "containers": {"cna": {"title": "MyTube has Mass Assignment via Settings Management", "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx"}, {"name": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6", "tags": ["x_refsource_MISC"], "url": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6"}], "affected": [{"vendor": "franklioxygen", "product": "MyTube", "versions": [{"version": "< 1.7.79", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T23:59:56.045Z"}, "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78."}], "source": {"advisory": "GHSA-c938-x24g-fxcx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T16:14:35.666469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T16:14:36.654Z"}}]}}

{"affected": [{"affectedData": [{"product": "MyTube", "vendor": "franklioxygen", "versions": [{"status": "affected", "version": "< 1.7.79"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E0CEE7C-45C8-43F1-833A-3E60F1561273", "versionEndExcluding": "1.7.78", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78."}, {"lang": "es", "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de v\u00eddeo. Las versiones 1.7.78 e inferiores tienen una vulnerabilidad de Asignaci\u00f3n Masiva en la funcionalidad de gesti\u00f3n de configuraciones debido a una validaci\u00f3n de entrada insuficiente. La funci\u00f3n saveSettings() de la aplicaci\u00f3n acepta pares clave-valor arbitrarios sin validar los nombres de las propiedades contra las configuraciones permitidas. La funci\u00f3n utiliza Record como tipo de entrada e itera sobre todas las entradas usando Object.entries() sin filtrar propiedades no autorizadas. Cualquier campo enviado por el atacante se persiste directamente en la base de datos, independientemente de si corresponde a una configuraci\u00f3n leg\u00edtima de la aplicaci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 1.7.78."}], "id": "CVE-2026-24140", "lastModified": "2026-06-17T10:22:41.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24140", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T16:14:35.666469Z", "version": "2.0.3"}}]}, "published": "2026-01-24T00:15:49.450", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:51:25.361438+00:00", "value": {"mitigation_remediation": ["Upgrade MyTube to version 1.7.78 or later, which contains the mass assignment fix.", "Modify the saveSettings() implementation to validate property keys against an allowed list of settings before writing to the database.", "Audit existing configuration records for unauthorized settings and remediate any discovered anomalies."], "summary": {"action": "Patch", "impact": "Unauthorized Settings Modification"}, "threat_synthesis": {"affected_systems": "The flaw affects the open\u2011source video downloader and player MyTube by franklioxygen, specifically all versions before 1.7.78. Version 1.7.78 and later contain a fix for the issue.", "description_and_impact": "A mass assignment vulnerability exists in the settings management function of MyTube, where the application\u2019s saveSettings() method accepts arbitrary key\u2011value pairs without filtering them against an allowed list. The effect is that any setting sent by an attacker is persisted directly to the database, allowing alteration of application behavior through unauthorized configuration changes. This weakness can lead to unintended functionality or data exposure and is identified as CWE\u2011915.", "risk_and_exploitability": "The CVSS score of 2.7 indicates low to moderate severity, and the EPSS score of less than 1% signals a very low but non\u2011zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. As the flaw is tied to the settings API, the likely attack vector is via authenticated users submitting arbitrary configuration data, although the exact method is not detailed in the advisory and is inferred from the API design."}}}}, "created": "2026-01-26T11:48:50.728833+00:00", "updated": "2026-04-18T20:00:09.292241+00:00", "vendors": ["franklioxygen", "franklioxygen$PRODUCT$mytube"]}