pyLoad's Session Not Invalidated After Permission Changes
Date: 2026-04
Affected: pip/pyload-ng
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-613

### Summary The `pyload` application does not properly invalidate or modify sessions upon changes made to a user's permissions. ### Details Whenever an administrator changes the permissions a specific account has, they do not expect that account still being able to access data that their new permissions do not allow. This is not the case for the `pyload` application, as a user with a valid session can still perform the actions. ### PoC Take a user with all the permissions, as shown below. ![image](https://user-images.githubusercontent.com/44903767/294956335-0e4da84f-bf9a-42c8-87f1-f5ff35967c63.png) We now log in as this user. ![image](https://user-images.githubusercontent.com/44903767/294956539-ac6805fe-957d-4289-8ca9-2f3b6b2878a3.png) Let us now take away all the permissions. ![image](https://user-images.githubusercontent.com/44903767/294956689-757e6e08-03fd-42eb-b4a5-1ceefa6c24ed.png) The logged in session can still be used to access everything in the application. ![image](https://user-images.githubusercontent.com/44903767/294956943-fa0f23c0-a28c-4eed-89d6-1cc074feda6d.png) ### Impact Should permissions be taken away, then the user is expected not to be able to execute the actions belonging to those actions anymore.


Mitigations:

Architectural layers (MAESTRO):