https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 00:37:17 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123813 <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user&#39;s permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user&#39;s permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123813 https://db.gcve.eu/vuln/ghsa-jq7h-wrvp-3rgx <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>An admin who revokes a user&#39;s privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated.</p> <p>pyLoad authorizes each request from values copied into the Flask session at login. set_session in webui/app/helpers.py writes role and perms once, and both login_required and the session branch of apikey_auth read them back from the session rather than from the database. The fix for GHSA-66hx-chf7-3332 handled this by deleting the user&#39;s session files, but the call was added only in webui/app/blueprints/json_blueprint.py, at the three WebUI form handlers. Api.set_user_permission and Api.change_password in core/api/__init__.py write to the database and return. Both are exported over /api/&lt;func&gt; and both appear in the OpenAPI spec the project serves at /api, so the documented administration interface takes the unpatched route.</p> <p>I should concede an overlap up front. GHSA-66hx-chf7-3332 does name the core method in its own Details, pointing at set_user_permission and noting that it updates the database role and permission only. What that advisory does not do is name /api/set_user_permission as a reachable route, and it does not mention change_password at all, which is the half I think is new.</p> <p>I ran this against pyload-ng 0.5.0b3.dev101 installed from PyPI, on a real instance with real users. Demoting an admin from role 0 to role 1 with permission 0 by POSTing /api/set_user_permission updated the database immediately. T…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>An admin who revokes a user&#39;s privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated.</p> <p>pyLoad authorizes each request from values copied into the Flask session at login. set_session in webui/app/helpers.py writes role and perms once, and both login_required and the session branch of apikey_auth read them back from the session rather than from the database. The fix for GHSA-66hx-chf7-3332 handled this by deleting the user&#39;s session files, but the call was added only in webui/app/blueprints/json_blueprint.py, at the three WebUI form handlers. Api.set_user_permission and Api.change_password in core/api/__init__.py write to the database and return. Both are exported over /api/&lt;func&gt; and both appear in the OpenAPI spec the project serves at /api, so the documented administration interface takes the unpatched route.</p> <p>I should concede an overlap up front. GHSA-66hx-chf7-3332 does name the core method in its own Details, pointing at set_user_permission and noting that it updates the database role and permission only. What that advisory does not do is name /api/set_user_permission as a reachable route, and it does not mention change_password at all, which is the half I think is new.</p> <p>I ran this against pyload-ng 0.5.0b3.dev101 installed from PyPI, on a real instance with real users. Demoting an admin from role 0 to role 1 with permission 0 by POSTing /api/set_user_permission updated the database immediately. T…</p> https://db.gcve.eu/vuln/ghsa-jq7h-wrvp-3rgx