PT-2026-34223 · Pyload · Pyload

Komi22 · Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41133

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev98

Description An issue exists where role and permission are cached in the session during login. The system continues to authorize requests using these cached values even after an administrator modifies the user's role or permissions in the database. This allows a logged-in user to retain revoked privileges until the session expires or they log out, enabling continued unauthorized privileged actions.

Recommendations Update to a version that includes commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1.

Exploit

Fix

LPE

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-41133

GHSA-66HX-CHF7-3332

Affected Products

Pyload

References · 7

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332 · Exploit
• https://github.com/pyload/pyload/commit/e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 · Patch
• https://osv.dev/vulnerability/GHSA-66hx-chf7-3332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41133 · Security Note
• https://github.com/pyload/pyload · Note
• https://twitter.com/VulmonFeeds/status/2046822758177230850 · Twitter Post
• https://twitter.com/CVEnew/status/2048168400858521822 · Twitter Post