pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session — GHSA-JQ7H-WRVP-3RGX

Summary

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. set_session in webui/app/helpers.py writes role and perms once, and both login_required and the session branch of apikey_auth read them back from the session rather than from…

Timeline

Published by source

2026-10-09

Risk context

• Reported severity or threat level: high.
• Reported CVSS score: 7.5 out of 10.
• Review exposure for the affected product or family: pip: pyload-ng.

Product

pip: pyload-ng

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source

Evidence and provenance

Canonical advisory ID

GHSA-JQ7H-WRVP-3RGX

Source

GitHub

Vendor

GitHub

Published by source

2026-10-09

Last source activity

2026-10-09

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.