pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

• CVE-2026-40071: 0.22% estimated exploitation activity in the next 30 days; percentile 12.41 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model. Confirmed mismatches: - `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order` - `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`

Details pyLoad defines granular permissions in core API: - `order_package` requires `Perms.MODIFY` (`src/pyload/core/api/init.py:1125`) - `order_file` requires `Perms.MODIFY` (`src/pyload/core/api/init.py:1137`) - `stop_downloads` requires `Perms.MODIFY` (`src/pyload/core/api/init.py:1046`) But WebUI JSON routes use weaker checks: - `/json/package_order` uses `@login_required("ADD")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`) - `/json/link_order` uses…

Published by the source

8 Apr 2026, 00:18 UTC

Last modified by the source

26 Oct 2026, 16:15 UTC

Source last checked

27 Oct 2026, 06:15 UTC

1. Revision 4 · amended · 27 Oct 2026

   Amended from osv record GHSA-rfgh-63mg-8pwm

2. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-rfgh-63mg-8pwm

3. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-rfgh-63mg-8pwm

4. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-rfgh-63mg-8pwm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-40071

Advisory: pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
IDs: CVE-2026-40071, GHSA-rfgh-63mg-8pwm
Record: https://patchnext.com/advisories/cve-2026-40071 (revision 4, source checked 27 Oct 2026, 06:15 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: pyload-ng 0.5.0b3.dev97. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI pyload-ng: affected < 0.5.0b3.dev97; fixed in 0.5.0b3.dev97

## Suggested inspection (read-only)
- `python -m pip show pyload-ng`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pyload-ng.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-rfgh-63mg-8pwm (OSV record GHSA-rfgh-63mg-8pwm lists affected ranges: PyPI pyload-ng >=0 <=0.5.0b3)
- Verified: https://github.com/advisories/GHSA-rfgh-63mg-8pwm (GitHub-reviewed advisory GHSA-rfgh-63mg-8pwm lists affected ranges: PyPI pyload-ng >=0 <=0.5.0b3)
- Verified: https://github.com/advisories/GHSA-rfgh-63mg-8pwm (GitHub-reviewed advisory GHSA-rfgh-63mg-8pwm lists affected ranges: PyPI pyload-ng >=0 <0.5.0b3.dev97)
- Verified: https://osv.dev/vulnerability/GHSA-rfgh-63mg-8pwm (OSV record GHSA-rfgh-63mg-8pwm lists affected ranges: PyPI pyload-ng >=0 <0.5.0b3.dev97 (fixed))

Commands are suggestions: review each one before running it.