CVE-2026-41133 — pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Affected: pyload

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature. Commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 contains a fix for the issue.

GHSA-66hx-chf7-3332 — pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Affected: PyPI: pyload-ng

### Summary pyLoad caches `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database.

As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions.

This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature.

### Details The WebUI auth flow stores authorization state in session:

- `src/pyload/webui/app/helpers.py:187-200` - `set_session(...)` writes: - `"role": user_info["role"]` - `"perms": user_info["permission"]`

Authorization checks later trust cached session values:

- `src/pyload/webui/app/helpers.py:134-151` - `parse_permissions(...)` reads `session.get("role")` / `session.get("perms")` - `src/pyload/webui/app/helpers.py:225-230` - `is_authenticated(...)` only verifies `authenticated` and `api.user_exists(user)` (existence), not fresh role/permission - `src/pyload/webui/app/helpers.py:267-275` - `login_required(...)` uses `parse_permissions(s)` for allow/deny decisions - `src/pyload/webui/app/helpers.py:356-365` - API session auth path also trusts `s["role"]` and `s["perms"]`

Role/permission updates are written to DB but active sessions are not invalidated/refreshed:

- `src/pyload/webui/app/blueprints/json_blueprint.py:389-434` - `update_users(...)` calls `api.set_user_permission(...)` a…

Most recent entries from all

CVE-2026-41133 — pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

GHSA-66hx-chf7-3332 — pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)