pyLoad CVE-2026-41133

Requires existing authenticated access to a pyLoad instance with low-privilege user credentials (PR:L). Exploitation occurs specifically when an administrator modifies the attacker's user role or permissions while the attacker maintains an active authenticated session. The vulnerability manifests in multi-user pyLoad deployments where role-based access control is actively managed - environments with a single user or where role changes never occur are not practically exploitable. Session timeout configuration determines the duration of exploitability: longer session timeouts (common default) extend the window; shorter timeouts reduce but do not eliminate risk. No special network position, user interaction, or non-default configuration required beyond the baseline authenticated state.

Real-world risk is moderate despite the High CVSS 8.8 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, but critically requires existing low-privilege authentication - not a remote unauthenticated threat. EPSS data is not provided but would likely be low given the authentication prerequisite. No CISA KEV listing indicates this is not being actively exploited in the wild at scale. Risk materializes primarily in scenarios where: (1) pyLoad instances have multiple users with varying privilege levels, (2) administrators frequently adjust user roles (e.g., removing admin rights from compromised accounts or departing users), and (3) sessions have long timeout periods. Single-user deployments or installations without role changes face negligible risk. The publicly available patch commit provides attackers with exploitation blueprints, but the authentication barrier limits mass exploitation. Priority should be HIGH for multi-user production deployments, MEDIUM for shared environments with infrequent role changes, LOW for single-user personal instances.

A malicious user Bob has standard user privileges in a shared pyLoad instance. Bob logs in and obtains a valid session. An administrator then promotes Bob to admin temporarily to perform maintenance, then immediately demotes Bob back to standard user. Because pyLoad caches Bob's elevated role in his active session, Bob retains full administrative capabilities until he logs out or his session expires. Bob exploits this window to create new admin accounts, modify download queues of other users, or exfiltrate sensitive configuration data including stored credentials for remote file servers. The attack requires no special tools beyond Bob's existing authenticated session and standard pyLoad web interface access.