CVE-2026-40071

MEDIUM

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

Title source: cna
STIX 2.1

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

References (1)

Scores

CVSS v3 5.4
EPSS 0.0003
EPSS Percentile 10.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (3)
pyload/pyload < 2026-04-13
pyload/pyload < 0.5.0b3.dev97
pypi/pyload-ng 0PyPI
Published Apr 09, 2026
Tracked Since Apr 09, 2026