What is the CVSS score of CVE-2026-35586?

CVE-2026-35586 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35586?

Yes, a patch is available for CVE-2026-35586. Update the affected software to the latest version immediately.

Python CVE-2026-35586

EUVD-2026-19736 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-07 GitHub_M

GHSA-ppvx-rwh9-7rj7

Python Authentication Bypass

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 16:30 euvd

EUVD-2026-19736

Analysis Generated

Apr 07, 2026 - 16:30 vuln.today

CVE Published

Apr 07, 2026 - 16:09 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the ssl_certchain option was never added to the admin-only set at all. This vulnerability is fixed in 0.5.0b3.dev97.

AnalysisAI

Privilege escalation in pyLoad prior to 0.5.0b3.dev97 allows authenticated users with SETTINGS permission to bypass admin-only protections and modify SSL certificate and key file paths due to incorrect option name mappings in the ADMIN_ONLY_CORE_OPTIONS authorization set. The vulnerability arises from name mismatches (ssl_cert/ssl_key vs. ssl_certfile/ssl_keyfile) and complete omission of the ssl_certchain option from authorization checks, enabling any SETTINGS-privileged user to overwrite critical SSL configuration-a capability intended exclusively for administrators. CVSS 6.8 reflects high confidentiality and integrity impact with authenticated access required and high attack complexity.

Technical ContextAI

pyLoad is a Python-based download manager that implements role-based access control through permission sets. The vulnerability resides in the set_config_value() authorization mechanism, specifically the ADMIN_ONLY_CORE_OPTIONS set, which maintains a hardcoded list of configuration parameters that should only be modifiable by administrators. The root cause (CWE-863: Incorrect Authorization) stems from a naming inconsistency in the authorization logic: the code checks for options named 'ssl_cert' and 'ssl_key', but the actual configuration system uses 'ssl_certfile' and 'ssl_keyfile'. This mismatch causes the authorization check to always fail (the options under their correct names are never found in the admin-only list), defaulting to allow access. Additionally, 'ssl_certchain' was never registered in the protected options list at all. This combination allows users with basic SETTINGS permission to invoke configuration changes that should be restricted to the ADMIN role, effectively bypassing the intended authorization model.

RemediationAI

Upgrade pyLoad to version 0.5.0b3.dev97 or later, which corrects the option name mappings in ADMIN_ONLY_CORE_OPTIONS (ssl_cert and ssl_key to ssl_certfile and ssl_keyfile) and adds ssl_certchain to the protected options list. Users unable to upgrade immediately should restrict SETTINGS permission assignment to trusted administrators only and audit existing permission grants to ensure only authorized users hold this privilege. Monitor configuration change logs and SSL certificate paths for unexpected modifications. The fix is available in the official pyLoad repository (https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7) and should be deployed at the earliest opportunity given the sensitivity of SSL configuration.