CVE-2026-123813

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.

• CWE-613

• https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad
• https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx

Published

Nov 9, 2026

Last Modified

Nov 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123807Signal K Server is a server application that runs on a centr…9.8
• CVE-2026-123808Nuxt UI is an intuitive Vue UI library powered by Reka UI an…5.3
• CVE-2026-123809Dynatrace MCP Server is an MCP server for Dynatrace Observab…4.2
• CVE-2026-123810Dynatrace MCP Server is an MCP server for Dynatrace Observab…4.3
• CVE-2026-123811Dynatrace MCP Server is an MCP server for Dynatrace Observab…7.5
• CVE-2026-123812Dynatrace MCP Server is an MCP server for Dynatrace Observab…3.7
• CVE-2026-123814pyLoad is a free and open-source download manager written in…6.4
• CVE-2026-123815pyLoad is a free and open-source download manager written in…9.4
• CVE-2026-123816pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-123817AIOHTTP is an asynchronous HTTP client/server framework for …8.7
• CVE-2026-123818LMDeploy is a toolkit for compressing, deploying, and servin…7.5
• CVE-2026-123819Wagtail is an open source content management system built on…6.5