Verified

ghsa:GHSA-JQ7H-WRVP-3RGX: pyload-ng <= 0.5.0b3.dev101

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session. Affected range: <= 0.5.0b3.dev101.

Affected technology

pyload-ng · <= 0.5.0b3.dev101
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 13-Oct-2026 07:48 UTC

Product: pyload-ng
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-jq7h-wrvp-3rgx.html