CVE-2026-41133: 
Python vulnerability analysis and mitigation

CVE-2026-41133 is a stale session privilege / privilege revocation bypass vulnerability in pyLoad, a free and open-source Python-based download manager. The flaw affects all versions up to and including 0.5.0b3.dev97 (pip package pyload-ng <= 0.5.0b3), and was published on April 21–22, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory). The patched release is pyload-ng 0.5.0b3.dev98, introduced via commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 (GitHub Commit).

The root cause is classified as CWE-613 (Insufficient Session Expiration). At login, set_session() in src/pyload/webui/app/helpers.py writes the user's role and permission values into the session store; all subsequent authorization decisions — via parse_permissions(), login_required(), and the API session auth path — read these cached session values rather than querying the database for fresh values (GitHub Advisory). When an administrator updates a user's role or permissions via update_users() in json_blueprint.py, the change is written only to the database through api.set_user_permission(); active sessions are never invalidated or refreshed. Compounding the issue, the default session lifetime is configured to 44,640 minutes (~31 days) in default.cfg, meaning a demoted or restricted user can retain elevated privileges for up to a month without logging out (GitHub Advisory). A source-based PoC that validates all conditions for the bypass is publicly available in the security advisory (GitHub Advisory).

An authenticated user whose role or permissions have been administratively revoked can continue to perform all previously authorized privileged actions — including reading files, writing files, and executing download operations — until their session expires or they manually log out (GitHub Advisory). This affects confidentiality, integrity, and availability at a high level, as a demoted user retaining admin-level session tokens could access sensitive configuration data, manipulate downloads, or disrupt service. The default 31-day session lifetime significantly extends the exposure window, making timely privilege revocation effectively impossible without a service restart or manual session invalidation.

A public proof-of-concept (source-based Python script) is available in the GitHub Security Advisory, which validates all conditions for the privilege revocation bypass without requiring a live deployment (GitHub Advisory). The EPSS score is approximately 0.032%, indicating low current probability of automated exploitation. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time. Exploitation requires only low-level authenticated access (a valid session obtained before privilege revocation), making it accessible to any user who was previously granted access to the pyLoad instance.

1. Obtain initial access: Log in to the pyLoad WebUI with a user account that has elevated privileges (e.g., admin role or specific permissions). The session is created and role/perms are cached in the session store.
2. Trigger administrative revocation: An administrator changes the user's role or permissions via the WebUI (/json/update_users). The database is updated, but the attacker's active session is not invalidated in vulnerable versions.
3. Continue privileged actions: Using the still-valid session cookie, the attacker continues to send authenticated requests to privileged WebUI or API endpoints (e.g., file access, download management, configuration changes). Authorization checks read the stale cached session values and grant access.
4. Persist until session expiry: With the default session lifetime of ~31 days, the attacker can maintain unauthorized privileged access for an extended period without re-authenticating, unless the pyLoad service is restarted or sessions are manually cleared (GitHub Advisory).

• Logs: WebUI access logs showing continued privileged API calls (e.g., /json/ endpoints) from a user account after an administrator has modified that user's role or permissions in the database.
• Logs: Absence of a new login event from a user who is performing privileged actions after a known permission change — indicating stale session reuse.
• Network: Repeated authenticated requests to sensitive endpoints (e.g., /json/update_users, /json/add_package, file management routes) from a session that should have been downgraded.
• Application State: Discrepancy between the role/permissions stored in the pyLoad database for a user and the actions being successfully performed by that user's active session.

Upgrade pyload-ng to version 0.5.0b3.dev98 or later, which includes the fix in commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 that calls clear_all_user_sessions() whenever a user's role, permissions, or password are changed, or when a user is deleted (GitHub Commit). As a temporary workaround prior to patching, administrators should restart the pyLoad service immediately after revoking a user's privileges, which will invalidate all active sessions. Additionally, consider reducing the session lifetime from the default 44,640 minutes to a shorter value in default.cfg to limit the exposure window for stale sessions (GitHub Advisory).

The vulnerability was reported by researcher komi22 and published by GammaC0de on April 13, 2026 via the GitHub Security Advisory program (GitHub Advisory). Coverage appeared on aggregator sites including The Hacker Wire, VulDB, and INCIBE-CERT shortly after disclosure. Social media activity was limited, with automated CVE notification accounts on Bluesky and Nitter flagging the issue. No significant broader community debate or vendor controversy has been observed.