# CVE-2026-40071: pyload-ng improper authorization in WebUI JSON endpoints

Source: https://junglewise.ai/threats/cve-2026-40071-pyload-ng-improper-authorization-in-webui-json-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40071 · Severity: medium · CVSS 5.4 · Published 2026-04-08

pyload-ng, a popular open-source download manager, contains a flaw in how it checks user permissions within its web interface. This allows users who are only supposed to add or delete items to perform restricted management tasks, such as reordering the download queue or stopping active downloads. While this does not allow a full account takeover, it enables unauthorized users to disrupt operations and modify the organization of files.

Technologies: [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40071 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40071 being exploited in the wild.

**How severe is CVE-2026-40071?** Medium severity, with a CVSS score of 5.4, published 8 April 2026.

**Which products and versions are affected?** pyLoad Next Generation <= 0.5.0b3; pyload-ng (PyPI) <= 0.5.0b3, ECOSYSTEM:introduced=0,last_affected=0.5.0b3.

**Is there a fix for CVE-2026-40071?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40071 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40071?** Check whether you run pyLoad Next Generation or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A permission mismatch exists between the pyload-ng WebUI JSON endpoints and the core API. Specifically, endpoints such as /json/package_order, /json/link_order, and /json/abort_link use @login_required decorators with 'ADD' or 'DELETE' permissions, whereas the underlying core API methods (order_package, order_file, and stop_downloads) require 'MODIFY' permissions. An authenticated attacker with low-level privileges can exploit these endpoints to perform unauthorized actions, leading to horizontal privilege escalation. This results in an integrity impact via queue reordering and an availability impact via the unauthorized termination of active downloads. As of the advisory, no patched version is specified beyond the vulnerable range of <= 0.5.0b3.

## Affected products

- pyload pyload-ng <= 0.5.0b3

## Identifiers

- CVE-2026-40071
- GHSA-rfgh-63mg-8pwm
- PYSEC-2026-2997

## Timeline

- 2026-04-08: advisory: GitHub Advisory published
- 2026-04-09: disclosed: NVD publication date

## References

- [https://api.github.com/users/komi22](https://api.github.com/users/komi22)
- [https://github.com/komi22](https://github.com/komi22)
- [https://api.github.com/users/komi22/gists%7B/gist_id%7D](https://api.github.com/users/komi22/gists%7B/gist_id%7D)
- [https://api.github.com/users/komi22/repos](https://api.github.com/users/komi22/repos)
- [https://avatars.githubusercontent.com/u/92563389?v=4](https://avatars.githubusercontent.com/u/92563389?v=4)
- [https://api.github.com/users/komi22/events%7B/privacy%7D](https://api.github.com/users/komi22/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)