{"affected":[{"product":"pyload","source":"CNA: GitHub_M","vendor":"pyload","versions":[{"status":"affected","version":"< 0.5.0b3.dev102"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"pyload-ng","product":"pyload-ng","source":"OSV GHSA-jq7h-wrvp-3rgx","vendor":"","versions":[{"status":"affected","version":"0.5.0a5.dev528","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev532","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev535","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev536","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev537","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev539","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev540","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev545","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev562","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev564","versionType":"PyPI"},{"status":"affected","version":"0.5.0a5.dev565","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev570","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev578","versionType":"PyPI"},{"status":"affected","version":"0.5.0a6.dev587","versionType":"PyPI"},{"status":"affected","version":"0.5.0a7.dev596","versionType":"PyPI"},{"status":"affected","version":"0.5.0a8.dev602","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev615","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev629","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev632","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev641","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev643","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev655","versionType":"PyPI"},{"status":"affected","version":"0.5.0a9.dev806","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev1","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev2","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev3","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev4","versionType":"PyPI"},{"status":"affected","version":"0.5.0b1.dev5","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev10","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev11","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev12","versionType":"PyPI"},{"status":"affected","version":"0.5.0b2.dev9","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev100","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev101","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev13","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev14","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev17","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev18","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev19","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev20","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev21","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev22","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev24","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev26","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev27","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev28","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev29","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev30","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev31","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev32","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev33","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev34","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev35","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev38","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev39","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev40","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev41","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev42","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev43","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev44","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev45","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev46","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev47","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev48","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev49","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev50","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev51","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev52","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev53","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev54","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev57","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev60","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev62","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev64","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev65","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev66","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev67","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev68","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev69","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev70","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev71","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev72","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev73","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev74","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev75","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev76","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev77","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev78","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev79","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev80","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev81","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev82","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev85","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev87","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev88","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev89","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev90","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev91","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev92","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev93","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev94","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev95","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev96","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev97","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev98","versionType":"PyPI"},{"status":"affected","version":"0.5.0b3.dev99","versionType":"PyPI"},{"events":[{"introduced":"0"},{"last_affected":"0.5.0b3.dev101"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-123813","cwes":["CWE-613"],"description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794262717710,"publishedAt":1794258475582,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jq7h-wrvp-3rgx"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx"}],"remediation":[],"revision":"0980019c6133cc280b4c970d3d2c6acd05893808c4b65326e61fcf3061855693","sources":[{"modifiedAt":1794258475582,"name":"CNA: GitHub_M","retrievedAt":1794262156240,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123813"},{"modifiedAt":1794262717710,"name":"NVD","retrievedAt":1794269999213,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123813"},{"modifiedAt":1794258904150,"name":"OSV / GitHub Security Advisories","retrievedAt":1794262156903,"url":"https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx"}],"ssvc":null,"status":"published","title":"pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session","updatedAt":1794269999213}