CVE-2026-40071

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

• CWE-863

• https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwmExploit, Vendor Advisory
• https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwmExploit, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40066Anviz CX2 Lite and CX7 are vulnerable to unverified update p…8.8
• CVE-2026-40067When a BIG-IP APM access policy is configured on a virtual s…8.7
• CVE-2026-40068In versions 2.1.63 through 2.1.83 of Claude Code, the folder…8.8
• CVE-2026-40069BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…7.5
• CVE-2026-4007A vulnerability was detected in Tenda W3 1.0.0.3(2204). This…8.8
• CVE-2026-40070BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…8.1
• CVE-2026-40072web3.py allows you to interact with the Ethereum blockchain …7.2
• CVE-2026-40073SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40074SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
• CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
• CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1