VYPR
Get started
← All advisories
High severity8.8NVD Advisory· Published Apr 22, 2026· Updated Apr 27, 2026

CVE-2026-41133

CVE-2026-41133

Description

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature. Commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 contains a fix for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pyload-ngPyPI
<= 0.5.0b3.dev97—

Affected products

1
  • Pyload/Pyload
    cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
    Range: <2026-04-13

Patches

1
e95804fb0d06

invalidate user session on user modify/delete/password change (fixes GHSA-66hx-chf7-3332 and GHSA-fj52-5g4h-gmq8 security advisories)

https://github.com/pyload/pyloadGammaC0deApr 13, 2026via ghsa
commit
1 file changed · +16 −4
  • src/pyload/webui/app/blueprints/json_blueprint.py+16 −4 modified
    @@ -9,7 +9,7 @@
 from pyload.core.api import Role
 from pyload.core.utils import format, fs
 
-from ..helpers import get_permission, login_required, permlist, render_template, set_permission
+from ..helpers import clear_all_user_sessions, get_permission, login_required, permlist, render_template, set_permission
 
 bp = flask.Blueprint("json", __name__)
 
@@ -360,6 +360,7 @@ def change_password(user_login, user_curpw, user_newpw):
     if not done:
         return jsonify(False), 403  #: Wrong password
 
+    clear_all_user_sessions(user_login)
     return jsonify(True)
 
 @bp.route("/json/add_user", methods=["POST"], endpoint="add_user")
@@ -401,22 +402,29 @@ def update_users(update_data):
     # NOTE: messy code...
     for userdata in all_users.values():
         name = userdata.name
-        users[name] = {"perms": get_permission(userdata.permission)}
+        users[name] = {
+            "permission": userdata.permission,
+            "perms": get_permission(userdata.permission)
+        }
         users[name]["perms"]["admin"] = userdata.role == 0
         users[name]["role"] = userdata.role
 
     s = flask.session
     for name in list(users):
+        was_changed = False
         data = users[name]
         if update_data.get(f"{name}|delete"):
             if name != s["name"]:
                 api.remove_user(name)
                 del users[name]
+                clear_all_user_sessions(name)
             continue
         if update_data.get(f"{name}|admin"):
+            was_changed = data["role"] != 0
             data["role"] = 0
             data["perms"]["admin"] = True
-        elif name != s["name"]:
+        elif name != s["name"]:  #: deny removing 'self' admin role
+            was_changed = data["role"] != 1
             data["role"] = 1
             data["perms"]["admin"] = False
 
@@ -427,9 +435,13 @@ def update_users(update_data):
         for perm in update_data.get(f"{name}|perms", []):
             data["perms"][perm] = True
 
-        data["permission"] = set_permission(data["perms"])
+        new_permission = set_permission(data["perms"])
+        was_changed = was_changed or data["permission"] != new_permission
+        data["permission"] = new_permission
 
         api.set_user_permission(name, data["permission"], data["role"])
+        if was_changed:
+            clear_all_user_sessions(name)
 
     return jsonify(True)

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

4

News mentions

0

No linked articles in our index yet.