Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-40071

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pyload pyload

  • < 0.5.0b3.dev97affected

References