CVE-2026-123813— pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

Quick assessment

Affected

pyload pyload

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyLoad 是一款用 Python 编写的免费开源下载管理器。在版本 0.5.0b3.dev102 之前，当管理员通过或接口修改用户的权限或密码时，pyLoad 不会使现有的 Flask 会话失效。和虽然会更新数据库，但会话授权仍继续使用由中的在登录时复制的角色和权限值。因此，用户可以保留已被撤销的权限，或在配置的会话有效期内继续使用基于旧密码建立的会话。API 密钥认证不受此问题影响，因为该路径会重新从数据库读取用户数据。此问题已在版本 0.5.0b3.dev102 中修复。

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1551.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

Source: CVE Program / CVE List V5

Vulnerability Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不充分的会话过期机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pyload	pyload	< 0.5.0b3.dev102	-

II. Public POCs for CVE-2026-123813

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123813

请登录查看更多情报信息。

Other References for CVE-2026-123813 (2)

https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123813

Same Patch Batch · pyload · 2026-11-09 · 4 CVEs total

CVE-2026-123815	9.4 CRITICAL	pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile
CVE-2026-123816	8.1 HIGH	pyLoad: Authentication bypass in API key validation (check_apikey cache)
CVE-2026-123814	6.4 MEDIUM	pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.

IV. Related Vulnerabilities

Same product: pyload

Same vendor: pyload

Same weakness: CWE-613