# CVE-2026-123813: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- pyload / pyload: < 0.5.0b3.dev102 (affected). Source: CNA: GitHub_M
-  / pyload-ng (pyload-ng): 0.5.0a5.dev528 (affected, PyPI); 0.5.0a5.dev532 (affected, PyPI); 0.5.0a5.dev535 (affected, PyPI); 0.5.0a5.dev536 (affected, PyPI); 0.5.0a5.dev537 (affected, PyPI); 0.5.0a5.dev539 (affected, PyPI); 0.5.0a5.dev540 (affected, PyPI); 0.5.0a5.dev545 (affected, PyPI); 0.5.0a5.dev562 (affected, PyPI); 0.5.0a5.dev564 (affected, PyPI); 0.5.0a5.dev565 (affected, PyPI); 0.5.0a6.dev570 (affected, PyPI); 0.5.0a6.dev578 (affected, PyPI); 0.5.0a6.dev587 (affected, PyPI); 0.5.0a7.dev596 (affected, PyPI); 0.5.0a8.dev602 (affected, PyPI); 0.5.0a9.dev615 (affected, PyPI); 0.5.0a9.dev629 (affected, PyPI); 0.5.0a9.dev632 (affected, PyPI); 0.5.0a9.dev641 (affected, PyPI); 0.5.0a9.dev643 (affected, PyPI); 0.5.0a9.dev655 (affected, PyPI); 0.5.0a9.dev806 (affected, PyPI); 0.5.0b1.dev1 (affected, PyPI); 0.5.0b1.dev2 (affected, PyPI); 0.5.0b1.dev3 (affected, PyPI); 0.5.0b1.dev4 (affected, PyPI); 0.5.0b1.dev5 (affected, PyPI); 0.5.0b2.dev10 (affected, PyPI); 0.5.0b2.dev11 (affected, PyPI); 0.5.0b2.dev12 (affected, PyPI); 0.5.0b2.dev9 (affected, PyPI); 0.5.0b3.dev100 (affected, PyPI); 0.5.0b3.dev101 (affected, PyPI); 0.5.0b3.dev13 (affected, PyPI); 0.5.0b3.dev14 (affected, PyPI); 0.5.0b3.dev17 (affected, PyPI); 0.5.0b3.dev18 (affected, PyPI); 0.5.0b3.dev19 (affected, PyPI); 0.5.0b3.dev20 (affected, PyPI); 0.5.0b3.dev21 (affected, PyPI); 0.5.0b3.dev22 (affected, PyPI); 0.5.0b3.dev24 (affected, PyPI); 0.5.0b3.dev26 (affected, PyPI); 0.5.0b3.dev27 (affected, PyPI); 0.5.0b3.dev28 (affected, PyPI); 0.5.0b3.dev29 (affected, PyPI); 0.5.0b3.dev30 (affected, PyPI); 0.5.0b3.dev31 (affected, PyPI); 0.5.0b3.dev32 (affected, PyPI); 0.5.0b3.dev33 (affected, PyPI); 0.5.0b3.dev34 (affected, PyPI); 0.5.0b3.dev35 (affected, PyPI); 0.5.0b3.dev38 (affected, PyPI); 0.5.0b3.dev39 (affected, PyPI); 0.5.0b3.dev40 (affected, PyPI); 0.5.0b3.dev41 (affected, PyPI); 0.5.0b3.dev42 (affected, PyPI); 0.5.0b3.dev43 (affected, PyPI); 0.5.0b3.dev44 (affected, PyPI); 0.5.0b3.dev45 (affected, PyPI); 0.5.0b3.dev46 (affected, PyPI); 0.5.0b3.dev47 (affected, PyPI); 0.5.0b3.dev48 (affected, PyPI); 0.5.0b3.dev49 (affected, PyPI); 0.5.0b3.dev50 (affected, PyPI); 0.5.0b3.dev51 (affected, PyPI); 0.5.0b3.dev52 (affected, PyPI); 0.5.0b3.dev53 (affected, PyPI); 0.5.0b3.dev54 (affected, PyPI); 0.5.0b3.dev57 (affected, PyPI); 0.5.0b3.dev60 (affected, PyPI); 0.5.0b3.dev62 (affected, PyPI); 0.5.0b3.dev64 (affected, PyPI); 0.5.0b3.dev65 (affected, PyPI); 0.5.0b3.dev66 (affected, PyPI); 0.5.0b3.dev67 (affected, PyPI); 0.5.0b3.dev68 (affected, PyPI); 0.5.0b3.dev69 (affected, PyPI); 0.5.0b3.dev70 (affected, PyPI); 0.5.0b3.dev71 (affected, PyPI); 0.5.0b3.dev72 (affected, PyPI); 0.5.0b3.dev73 (affected, PyPI); 0.5.0b3.dev74 (affected, PyPI); 0.5.0b3.dev75 (affected, PyPI); 0.5.0b3.dev76 (affected, PyPI); 0.5.0b3.dev77 (affected, PyPI); 0.5.0b3.dev78 (affected, PyPI); 0.5.0b3.dev79 (affected, PyPI); 0.5.0b3.dev80 (affected, PyPI); 0.5.0b3.dev81 (affected, PyPI); 0.5.0b3.dev82 (affected, PyPI); 0.5.0b3.dev85 (affected, PyPI); 0.5.0b3.dev87 (affected, PyPI); 0.5.0b3.dev88 (affected, PyPI); 0.5.0b3.dev89 (affected, PyPI); 0.5.0b3.dev90 (affected, PyPI); 0.5.0b3.dev91 (affected, PyPI); 0.5.0b3.dev92 (affected, PyPI); 0.5.0b3.dev93 (affected, PyPI); 0.5.0b3.dev94 (affected, PyPI); 0.5.0b3.dev95 (affected, PyPI); 0.5.0b3.dev96 (affected, PyPI); 0.5.0b3.dev97 (affected, PyPI); 0.5.0b3.dev98 (affected, PyPI); 0.5.0b3.dev99 (affected, PyPI); Ecosystem version events: introduced 0; last affected 0.5.0b3.dev101. Source: OSV GHSA-jq7h-wrvp-3rgx

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-613

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad (security-advisories@github.com)

- https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx (security-advisories@github.com)

- https://github.com/advisories/GHSA-jq7h-wrvp-3rgx (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-123813; retrieved 2026-11-09; source updated 2026-11-09

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123813; retrieved 2026-11-10; source updated 2026-11-09

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx; retrieved 2026-11-09; source updated 2026-11-09

Revision: 0980019c6133cc280b4c970d3d2c6acd05893808c4b65326e61fcf3061855693

Canonical: https://y2.dev/cve/CVE-2026-123813

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.