CVE-2026-40071 MEDIUM

CVE-2026-40071: pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

Vendor Pyload
Product pyload
Weakness CWE-863 · Incorrect authorization
Published April 9, 2026
Last update April 10, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

Key dates

02Disclosure timeline

April 9, 2026 CVE published
April 10, 2026 Record updated