CVE-2026-40071 — Incorrect Authorization in Pyload

CWE-863 — Incorrect AuthorizationCWE-285 — Improper Authorization35 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 90.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PyloadPyload-ng Project Pyload-ng
Timeline
PublishedApr 9

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5pyload/pyload< 0.5.0b3.dev97

🔴Vulnerability Details

3
VulDB
pyLoad up to 0.5.0b3.dev96 WebUI JSON Endpoint /json/package_order authorization↗2026-04-09
▶
CVEList
pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions↗2026-04-09
▶
GHSA
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions↗2026-04-08
▶

🕵️Threat Intelligence

31
Wiz
CVE-2026-33753 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-39844 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-40087 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-39890 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-35592 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-40071 — Incorrect Authorization in Pyload | cvebase