CVE-2026-40071: pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40071?
The severity of CVE-2026-40071 is classified as medium with a score of 5.4.
How do I fix CVE-2026-40071?
To fix CVE-2026-40071, update pyLoad to version 0.5.0b3.dev97 or later.
What vulnerabilities does CVE-2026-40071 exploit?
CVE-2026-40071 exploits the JSON permission mismatch in the pyLoad WebUI, allowing low-privileged users to perform modify actions.
Which versions of pyLoad are affected by CVE-2026-40071?
CVE-2026-40071 affects pyLoad versions prior to 0.5.0b3.dev97.
What impact does CVE-2026-40071 have on users?
CVE-2026-40071 allows authenticated low-privileged users to invoke modify-only actions, potentially leading to unauthorized modifications.