Is CVE-2026-40071 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40071 being exploited in the wild.

How severe is CVE-2026-40071?

Medium severity, with a CVSS score of 5.4, published 8 April 2026.

Which products and versions are affected?

pyLoad Next Generation <= 0.5.0b3; pyload-ng (PyPI) <= 0.5.0b3, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.

Is there a fix for CVE-2026-40071?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40071 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40071?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40071: pyload-ng improper authorization in WebUI JSON endpoints

Q: Is there a fix for CVE-2026-40071?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-40071 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-40071?

Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40071 · Severity: medium · CVSS 5.4 · Published 2026-04-08

pyload-ng, a popular open-source download manager, contains a flaw in how it checks user permissions within its web interface. This allows users who are only supposed to add or delete items to perform restricted management tasks, such as reordering the download queue or stopping active downloads. While this does not allow a full account takeover, it enables unauthorized users to disrupt operations and modify the organization of files.

Technologies: pyLoad Next Generation, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-40071 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40071 being exploited in the wild.
How severe is CVE-2026-40071?: Medium severity, with a CVSS score of 5.4, published 8 April 2026.
Which products and versions are affected?: pyLoad Next Generation <= 0.5.0b3; pyload-ng (PyPI) <= 0.5.0b3, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.
Is there a fix for CVE-2026-40071?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40071 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40071?: Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A permission mismatch exists between the pyload-ng WebUI JSON endpoints and the core API. Specifically, endpoints such as /json/package_order, /json/link_order, and /json/abort_link use @login_required decorators with 'ADD' or 'DELETE' permissions, whereas the underlying core API methods (order_package, order_file, and stop_downloads) require 'MODIFY' permissions. An authenticated attacker with low-level privileges can exploit these endpoints to perform unauthorized actions, leading to horizontal privilege escalation. This results in an integrity impact via queue reordering and an availability impact via the unauthorized termination of active downloads. As of the advisory, no patched version is specified beyond the vulnerable range of <= 0.5.0b3.

Affected products

pyload pyload-ng <= 0.5.0b3

Identifiers

CVE-2026-40071
GHSA-rfgh-63mg-8pwm
PYSEC-2026-2997

Timeline

2026-04-08: advisory: GitHub Advisory published
2026-04-09: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.