PT-2026-31673 · Pyload · Pyload

Komi22 · Published 2026-04-08 · Updated 2026-04-28 · CVE-2026-40071

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97

Description Certain WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke, allowing authenticated low-privileged users to execute MODIFY operations that should be denied by the permission model. Specifically, users with ADD permissions can reorder packages and files via endpoints '/json/package order' and '/json/link order', while users with DELETE permissions can abort downloads via '/json/abort link'. This occurs because these endpoints call core API functions order package(), order file(), and stop downloads(), which normally require MODIFY permissions, but the endpoints themselves use weaker authorization checks.

Recommendations Update to version 0.5.0b3.dev97.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2026-40071

GHSA-RFGH-63MG-8PWM

Affected Products

Pyload

References · 5

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwm · Exploit
• https://osv.dev/vulnerability/GHSA-rfgh-63mg-8pwm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40071 · Security Note
• https://github.com/pyload/pyload · Note
• https://t.me/cveNotify/161179 · Telegram Post