CVE-2026-40071: 
Python vulnerability analysis and mitigation

CVE-2026-40071 is an incorrect authorization vulnerability in pyLoad, a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, the WebUI JSON endpoints /json/package_order, /json/link_order, and /json/abort_link enforce weaker permission checks than the core API methods they invoke, allowing authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. The vulnerability was published on April 9, 2026, and affects all pyload-ng versions up to and including 0.5.0b3. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a permission mismatch (CWE-863: Incorrect Authorization / CWE-285: Improper Authorization) between the WebUI JSON blueprint and the core API layer. Specifically, the core API enforces Perms.MODIFY for order_package, order_file, and stop_downloads, but the corresponding WebUI routes use weaker decorators: /json/package_order and /json/link_order use @login_required("ADD"), while /json/abort_link uses @login_required("DELETE"). An attacker with only ADD or DELETE permissions can send authenticated HTTP POST requests directly to these endpoints, bypassing the MODIFY permission check entirely and successfully invoking the underlying API methods. This is inconsistent with other endpoints in the same blueprint (e.g., /json/move_package and /json/edit_package) that correctly require MODIFY, indicating the mismatch is unintentional (GitHub Advisory).

Successful exploitation allows authenticated low-privileged users to perform horizontal privilege escalation within pyLoad's permission model — specifically, executing MODIFY-class operations without holding the MODIFY permission. Integrity is impacted through unauthorized reordering of download queues and files, while availability is impacted through unauthorized abortion of active downloads. There is no confidentiality impact, and the scope is limited to the pyLoad instance itself; lateral movement to other systems is not a direct consequence (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, consisting of two complete, runnable Python scripts that demonstrate the permission bypass against a Flask test application. The EPSS score is approximately 0.029% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time. Exploitation requires valid credentials for a low-privileged account on the pyLoad instance, limiting the attack surface to authenticated users (GitHub Advisory).

1. Reconnaissance: Identify a pyLoad instance running a version prior to 0.5.0b3.dev97 with the WebUI accessible over the network.
2. Obtain low-privileged credentials: Acquire valid credentials for a pyLoad account with only ADD or DELETE permissions (not MODIFY).
3. Authenticate: Log in to the pyLoad WebUI to establish an authenticated session cookie.
4. Send crafted POST request to bypass permission check: Using the authenticated session, send an HTTP POST request directly to one of the vulnerable endpoints:
   • To reorder packages (requires only ADD): POST /json/package_order with JSON body {"pack_id": <id>, "pos": <position>}
   • To reorder files (requires only ADD): POST /json/link_order with JSON body {"file_id": <id>, "pos": <position>}
   • To abort downloads (requires only DELETE): POST /json/abort_link with JSON body {"link_id": <id>}
5. Confirm unauthorized MODIFY operation: The endpoint returns HTTP 200 with {"response": "success"}, confirming the MODIFY-class API method was invoked despite the user lacking MODIFY permission (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /json/package_order, /json/link_order, or /json/abort_link from accounts that hold only ADD or DELETE permissions.
• Logs: WebUI access logs showing successful (HTTP 200) responses to the above endpoints from low-privileged user sessions; cross-reference session user permission level against the endpoint accessed.
• Application Behavior: Unexplained changes to download queue ordering or unexpected abortion of active downloads not initiated by users with MODIFY permissions.

Upgrade pyLoad (pyload-ng) to version 0.5.0b3.dev97 or later, which corrects the permission checks on the affected WebUI JSON endpoints. As a temporary workaround prior to patching, restrict network access to the pyLoad WebUI to trusted users only, and audit existing user accounts to minimize the number of accounts with ADD or DELETE permissions. Review WebUI access logs for unauthorized MODIFY operations on package and link resources (GitHub Advisory).