CVE-2026-35586 — Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

Affected: pyload

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the ssl_certchain option was never added to the admin-only set at all. This vulnerability is fixed in 0.5.0b3.dev97.

GHSA-ppvx-rwh9-7rj7 — pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

Affected: PyPI: pyload-ng

## Summary

The `ADMIN_ONLY_CORE_OPTIONS` authorization set in `set_config_value()` uses incorrect option names `ssl_cert` and `ssl_key`, while the actual configuration option names are `ssl_certfile` and `ssl_keyfile`. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the `ssl_certchain` option was never added to the admin-only set at all.

## Details

The vulnerability is in `src/pyload/core/api/__init__.py`. The `ADMIN_ONLY_CORE_OPTIONS` set is defined at lines 237-248:

```python ADMIN_ONLY_CORE_OPTIONS = { ("general", "storage_folder"), ("log", "syslog_host"), ("log", "syslog_port"), ("proxy", "password"), ("proxy", "username"), ("reconnect", "script"), ("webui", "host"), ("webui", "ssl_cert"), # BUG: should be "ssl_certfile" ("webui", "ssl_key"), # BUG: should be "ssl_keyfile" ("webui", "use_ssl"), } # NOTE: ("webui", "ssl_certchain") is entirely missing ```

The actual config option names are defined in `src/pyload/core/config/default.cfg:39-41`:

``` file ssl_certfile : "SSL Certificate" = ssl.crt file ssl_keyfile : "SSL Key" = ssl.key file ssl_certchain : "CA's intermediate certificate bundle (optional)" = ```

The authorization check at line 267 compares the incoming `(category, option)` tuple against this set:

```python if (category, option) in ADMIN_ONLY_CORE_OPTIONS and not is_…

Most recent entries from all

CVE-2026-35586 — Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

GHSA-ppvx-rwh9-7rj7 — pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng