What is the CVSS score of CVE-2026-41133?

CVE-2026-41133 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of pyLoad are affected by CVE-2026-41133?

pyLoad versions 0.5.0b3.dev97 and earlier contain a session fixation vulnerability allowing authenticated users to retain administrative privileges after demotion, potentially enabling unauthorized…

How to fix or mitigate CVE-2026-41133?

Within 24 hours: Inventory all pyLoad deployments and identify instances running version 0.5.0b3.dev97 or earlier; document active user sessions with administrative privileges. Within 7 days: Force logout all users from affected pyLoad instances and require re-authentication; implement session timeout policies to 4 hours or less during elevated access. Within 30 days: Monitor pyLoad project for patch release (current status: no vendor patch identified); evaluate migration to alternative tools or isolation of affected deployments until patched version becomes available; establish change control requiring session termination before privilege modifications take effect.

pyLoad CVE-2026-41133

HIGH

Insufficient Session Expiration (CWE-613)

2026-04-22 security-advisories@github.com

GHSA-66hx-chf7-3332

Information Disclosure Python

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 00:58 vuln.today

Analysis Generated

Apr 22, 2026 - 00:22 vuln.today

CVE Published

Apr 22, 2026 - 00:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature. Commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 contains a fix for the issue.

AnalysisAI

Session fixation in pyLoad 0.5.0b3.dev97 and earlier allows authenticated users to retain revoked administrative privileges until logout. After an administrator demotes a user's role or revokes permissions, the affected user's active session continues to operate with the old cached privileges, enabling unauthorized administrative actions. Publicly available exploit code exists via GitHub commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1. With CVSS 8.8 (High) but requiring low-privilege authentication (PR:L), this represents an elevation-of-privilege vector in multi-user pyLoad deployments where role changes are expected to take immediate effect.

Technical ContextAI

This vulnerability stems from CWE-613 (Insufficient Session Expiration), a session management flaw where pyLoad's authentication subsystem caches user role and permission data in the session object at login time. When administrators modify user privileges through the database or admin interface, the application fails to invalidate or refresh existing sessions. The Python-based session handler does not implement real-time authorization checks against the current database state, instead relying on stale cached values until the session expires naturally or the user manually logs out. This creates a window where revoked privileges remain exploitable, violating the principle of immediate privilege revocation common in multi-tenant or role-based access control systems.

RemediationAI

Upgrade to pyLoad commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 or later, which implements real-time privilege checking against current database state rather than cached session values. Users can apply the patch directly from https://github.com/pyload/pyload/commit/e95804fb0d06cbb07d2ba380fc494d9ff89b68c1. If immediate patching is not feasible, implement compensating controls: (1) Force logout of all active sessions after making any role/permission changes via administrative tools or by restarting the pyLoad service (causes service interruption for all users), (2) Reduce session timeout values to minimize the window of stale privilege retention (trade-off: increases user login frequency and inconvenience), (3) Monitor audit logs for privilege escalation attempts by cross-referencing user actions against current database roles (requires manual review overhead). Note that these workarounds do not eliminate the vulnerability and may impact usability. Official vendor advisory available at https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332.