What’s Vulnerable › Vulnerabilities

CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-22 · updated 2026-06-17
• Weakness: CWE-613

Description

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature. Commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 contains a fix for the issue.

Affected products

• pyload/pyload: before 2026-04-13 — fixed in 2026-04-13

How to fix

Upgrade to a fixed version: pyload/pyload 2026-04-13. Check the vendor advisory for mitigations.

References

• https://github.com/pyload/pyload/commit/e95804fb0d06cbb07d2ba380fc494d9ff89b68c1
• https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332
• https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332

Get alerted when CVE-2026-41133 or the next vulnerability affects your stack