Read the docs
TI-2026-28902 Aliases CVE-2026-40071GHSA-rfgh-63mg-8pwm

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

Priority MEDIUM 58CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pyload (pyload): 0.5.0b3.dev97pyload-ng (PyPI): 0.5.0b3.dev97

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyloadpyloadbefore 0.5.0b3.dev970.5.0b3.dev97Patch availableCNA
—pyload-ng (PyPI)before 0.5.0b3.dev970.5.0b3.dev97Patch availableGHSA-rfgh-63mg-8pwm
  • pyload Vendorpyload Affected before 0.5.0b3.dev97 Fixed in 0.5.0b3.dev97 Patch available CNA
  • pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev97 Fixed in 0.5.0b3.dev97 Patch available GHSA-rfgh-63mg-8pwm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*before 2026-04-13Vulnerablepyload
  • cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:* Versions before 2026-04-13 Vulnerable ·pyload

Remediation

  • Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev97
  • Fix · GHSA-rfgh-63mg-8pwm pyload-ng (PyPI) Fixed in 0.5.0b3.dev97 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40071
  2. 2026-10-03 Alias added: GHSA-rfgh-63mg-8pwm

References

Exploit 1

Advisory 1

Other 4

  • TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
  • TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3
  • TI-2026-25907 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVSS 4.0HIGH 8.8
  • TI-2024-32088 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API CVSS 3.1CRITICAL 9.1
  • TI-2026-29761 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences