Session Management Flaw in pyLoad Download Manager by pyLoad Team
CVE-2026-123813

7.5HIGH

Key Information:

Vendor

Pyload

Status
Pyload
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123813?

pyLoad, a widely-used open-source download manager, has a session management vulnerability that allows users to retain access privileges even after their permissions have been revoked. This issue arises when an administrator alters a user's permissions or password via the API without invalidating existing Flask sessions. As a result, users can exploit this vulnerability to maintain access with outdated credentials for the lifetime of their session. The vulnerability has been addressed in version 0.5.0b3.dev102.

Affected Version(s)

pyload < 0.5.0b3.dev102

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/3e726ba271a6b1015...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.