Session Consistency Flaw in pyLoad Download Manager

CVE-2026-41133

What is CVE-2026-41133?

pyLoad, an open-source download manager written in Python, has a session management issue that allows users to retain old privileges post role or permission changes. Specifically, versions up to 0.5.0b3.dev97 cache user roles and permissions in the session, which continue to be used for request authorizations despite changes made by an administrator. This improper handling can leave users with revoked access persisting until they log out or their session expires, raising significant security concerns without having the optional security feature toggle providing any resolution. A fix is available in commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1. For further details, check the advisory and commit.

References