{"id":"CVE-2026-123813","published":"2026-11-09T22:18:37.587","lastModified":"2026-11-09T22:18:37.710","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-613"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx","tags":[]}],"exploitRefs":[{"url":"https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx","tags":[]}],"hasPoc":true,"ai":null}