CVE-2026-41133: pyLoad Privilege Escalation Vulnerability

CVE-2026-41133 Overview

A session authorization bypass vulnerability has been identified in pyLoad, a free and open-source download manager written in Python. The vulnerability exists in versions up to and including 0.5.0b3.dev97 where the application caches role and permission values in the session at login time. This cached authorization data continues to be used for authorizing requests even after an administrator changes the user's role or permissions in the database. As a result, an already logged-in user can retain old (revoked) privileges until logout or session expiry, enabling continued privileged actions that should have been denied.

Critical Impact

Users with revoked permissions can continue performing privileged operations until their session expires, potentially allowing unauthorized access to sensitive download management functions and system configurations.

Affected Products

• pyLoad versions up to and including 0.5.0b3.dev97

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-41133 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41133

Vulnerability Analysis

This vulnerability is classified as CWE-613 (Insufficient Session Expiration), affecting the core authorization and session-consistency mechanism in pyLoad. The fundamental issue lies in how the application handles authorization state throughout a user's session lifecycle.

When a user authenticates to pyLoad, the application captures and caches the user's role and permission values within the session object at the moment of login. This design decision creates a critical gap between the actual authorization state stored in the database and the cached authorization state used for runtime access control decisions.

The impact of this vulnerability is significant for multi-user pyLoad deployments where administrators may need to modify user privileges in response to security incidents, policy changes, or personnel transitions. An attacker who anticipates privilege revocation could maintain an active session to preserve their elevated access indefinitely, limited only by the session's natural expiration time.

Root Cause

The root cause is the session-based caching of authorization attributes (role and permission) without implementing a mechanism to synchronize these cached values with the authoritative database state. The application performs a single authorization lookup at login and subsequently relies on stale cached data for all authorization decisions, creating a time-of-check time-of-use (TOCTOU) style inconsistency between the session state and database state.

Attack Vector

The attack leverages the network-accessible nature of pyLoad's web interface. An authenticated attacker with low-privilege requirements can exploit this vulnerability without user interaction:

1. An attacker authenticates to pyLoad and obtains an active session with elevated privileges (e.g., admin role)
2. An administrator detects suspicious activity and revokes the attacker's privileges through the user management interface
3. The database is updated to reflect the reduced permissions
4. The attacker's existing session continues to use the cached elevated privileges
5. The attacker can perform privileged actions until their session naturally expires or they explicitly log out

The fix for this vulnerability is contained in commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1, which addresses the session-consistency issue by ensuring authorization values are properly validated against the current database state.

Detection Methods for CVE-2026-41133

Indicators of Compromise

• Unusual privileged operations performed by users whose permissions have been recently revoked
• Session activity from accounts that should have reduced access levels based on recent administrative changes
• Discrepancies between user actions in logs and their current database-stored permissions

Detection Strategies

• Monitor pyLoad logs for administrative actions performed after corresponding privilege revocations in the database
• Implement log correlation between user permission changes and subsequent session activity
• Review active sessions for users whose roles have been modified to identify potential exploitation

Monitoring Recommendations

• Enable verbose logging for authorization decisions and user session activities
• Create alerts for privileged operations and cross-reference against recent permission modification events
• Monitor for long-running sessions, especially for accounts with recently changed permissions

How to Mitigate CVE-2026-41133

Immediate Actions Required

• Update pyLoad to a version containing commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1
• Force logout of all active sessions after updating to ensure clean session state
• Implement a process to invalidate sessions when user permissions are modified

Patch Information

The vulnerability has been addressed in commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1. Organizations should apply this fix by updating to the latest version of pyLoad that includes this commit. For detailed information about the fix, refer to the GitHub Commit Update and the GitHub Security Advisory GHSA-66hx-chf7-3332.

Workarounds

• Manually force logout all users after making any permission changes until the patch is applied
• Reduce session timeout values to minimize the window of exposure
• Implement network-level access controls to restrict pyLoad access to trusted hosts only
• Consider temporarily disabling multi-user functionality if feasible until the patch can be applied