MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when "loginEnabled=true" and a visitor password is configured. The frontend filter in "VideoContext.tsx" is only client-side, "roleBasedAuthMiddleware.ts" allows all visitor GET requests, and "storageService/videos.ts" performs "getVideos()" and "getVideoById(id)" queries without checking the caller's role or "visibility". A visitor can enumerate "/api/videos" or request "/api/videos/:id" to retrieve hidden "visibility"=0 records, exposing titles, "sourceUrl" values, "videoPath" values, subtitle paths and "thumbnailPath" values. The "serveMountVideo()" path also serves mounted video files without "visibility" checks. Leaked paths work against unauthenticated "/videos/*" and "/subtitles/*" routes, allowing media downloads without credentials. The RSS visitor feed already filters "visibility"=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.