https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:21:55.544546+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-40071 CVE-2026-40071 — pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions 2026-10-02T23:21:55.574436+00:00

Affected: pyload

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

 https://cve.radiocsirt.org/vuln/ghsa-rfgh-63mg-8pwm GHSA-rfgh-63mg-8pwm — pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions 2026-10-02T23:21:55.574492+00:00

Affected: PyPI: pyload-ng

### Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model.

Confirmed mismatches: - `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order` - `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`

### Details pyLoad defines granular permissions in core API: - `order_package` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1125`) - `order_file` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1137`) - `stop_downloads` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1046`)

But WebUI JSON routes use weaker checks: - `/json/package_order` uses `@login_required("ADD")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`) - `/json/link_order` uses `@login_required("ADD")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`) - `/json/abort_link` uses `@login_required("DELETE")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)

Why this is likely unintended (not just convenience): - The same JSON blueprint correctly protects other edit actions with `MODIFY`: - `/json/move_package` -> `@login_required("MODIFY")` (`json_blueprint.py:188-196`) - `/json/edi…