Invidious Playlist Video Deletion Authorization Bypass

Executive Summary

This vulnerability exists in Invidious through version 2.20260626.0 and is a broken object level authorization issue. It allows authenticated attackers to delete videos from other users' playlists by providing an arbitrary global video index in the remove_video action of the playlist endpoint.

Attackers can find the per-video index values from the public playlist JSON API and then use these values to delete videos from playlists they do not own, as there is no ownership validation in place.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized requests to the playlist video deletion endpoint that include video index values not owned by the authenticated user.

Specifically, an attacker exploits the remove_video action of the playlist endpoint by submitting a POST request to /playlist_ajax?action=remove_video with a video index obtained from the public playlist JSON API but associated with another user's playlist.

To detect such activity, you can log and analyze POST requests to the /playlist_ajax endpoint, looking for mismatches between the playlist_id and the video index being deleted.

• Use web server or application logs to identify POST requests to /playlist_ajax with action=remove_video.
• Check if the video index in the request corresponds to a video not owned by the authenticated user.
• Example command to search logs for suspicious deletion attempts (assuming logs are in access.log):
• grep 'POST /playlist_ajax?action=remove_video' access.log
• Further analysis requires correlating the video index with playlist ownership, which may involve querying the database or API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized deletion of videos from your playlists by other authenticated users. This means your curated playlists could be tampered with or permanently altered without your consent.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Invidious to a version that includes the security fix implemented in commit 77ad416.

This fix adds proper ownership verification in the remove_video action, ensuring that only the owner of a playlist can delete videos from it.

Until the update is applied, consider restricting access to the vulnerable endpoint or monitoring and blocking suspicious requests that attempt to delete videos from playlists not owned by the authenticated user.

• Apply the patch from commit 77ad416 or upgrade to a version of Invidious that includes this fix.
• Review and tighten access controls around the playlist deletion API.
• Monitor logs for suspicious deletion attempts and block offending accounts if necessary.

Useful 0 Not Useful 0