Pyload EUVD-2026-20998

CVSS 5.4 with PR:L (low privileges required) and AV:N/AC:L indicates a network-accessible vulnerability requiring valid authentication but with low complexity exploitation. The score reflects limited integrity and availability impact (I:L, A:L) with no confidentiality breach. Real-world risk is moderate: while CVSS is not critical, the vulnerability enables privilege escalation-a fundamental security boundary violation. The fact that it affects a download manager means attackers could manipulate download orders or abort operations to disrupt service or modify queue states. No active exploitation is confirmed (no KEV designation reported), and no public exploit code availability is indicated, reducing immediate threat level. However, the permission model violation makes this a priority fix for any multi-user pyLoad deployment where user isolation matters.

An authenticated user with minimal privileges (e.g., a restricted download-only account) could directly call the vulnerable WebUI JSON endpoints to reorder packages, modify link priorities, or abort downloads belonging to other users or system operations. Because the endpoints do not enforce the same permission checks as the core API, the attacker bypasses role-based access controls without requiring admin credentials. The attack requires valid authentication credentials but no social engineering or elevated privileges, making it a practical privilege escalation vector in shared multi-user deployments.