# pyLoad session invalidation bypass in privilege revocation and password change

Source: https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-10-09

pyLoad is a download management application that allows administrators to manage user accounts via a REST API. When an admin revokes a user's privileges or changes their password through the API, the user's existing session remains active for up to a month, allowing them to retain full administrator access even after being demoted and locked out of login.

Technologies: [pyLoad](https://junglewise.ai/threats/technologies/pyload), [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** pyLoad 0.5.0b3.dev101 and likely other versions; pyload-ng (PyPI) <= 0.5.0b3.dev101.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Limit the webui.session_lifetime configuration (default 44640 minutes) to a shorter interval to reduce the window in which a revoked session remains valid. Restrict REST API access to set_user_permission and change_password to trusted administrators and consider using API-key authentication instead of session-based authentication where possible. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run pyLoad or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Limit the webui.session_lifetime configuration (default 44640 minutes) to a shorter interval to reduce the window in which a revoked session remains valid. Restrict REST API access to set_user_permission and change_password to trusted administrators and consider using API-key authentication instead of session-based authentication where possible.

## Technical details

The vulnerability exists in pyLoad's session handling: role and permissions are cached in the Flask session at login and never re-validated against the database on subsequent requests. The core API methods set_user_permission and change_password in core/api/__init__.py update the database but do not invalidate the user's session, allowing an authenticated attacker with an active session to maintain privileges despite administrative revocation. The flaw affects only session-based authentication; API-key authentication is unaffected as it reads from the database per request.

## Affected products

- pyLoad pyLoad 0.5.0b3.dev101 and likely other versions

## Timeline

- 2026-10-09: disclosed

## Related threats

- [pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in)
- [pyLoad WindowsPhoneNotify SSRF in notification addon](https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in)
- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)