medium5.4
CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
Impact
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pyload-ng | < 0.5.0b3.dev97 | 0.5.0b3.dev97 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pyload | Pyload | before 2026-04-13 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rfgh-63mg-8pwm
- https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwm
- https://nvd.nist.gov/vuln/detail/CVE-2026-40071
- https://github.com/pyload/pyload/commit/9ce88a8b01bed81aa17380c3288bb8c973e0859f
- https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-2997.yaml
- https://pypi.org/project/pyload-ng