What is the CVSS score of EUVD-2026-20998?

EUVD-2026-20998 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-20998?

Yes, a patch is available for EUVD-2026-20998. Update the affected software to the latest version immediately.

Python EUVD-2026-20998

| CVE-2026-40071 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-09 GitHub_M

Authentication Bypass Python

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.5.0b3.dev97

EUVD ID Assigned

Apr 09, 2026 - 18:15 euvd

EUVD-2026-20998

Analysis Generated

Apr 09, 2026 - 18:15 vuln.today

CVE Published

Apr 09, 2026 - 17:36 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

AnalysisAI

Authenticated privilege escalation in pyLoad's WebUI JSON endpoints (/json/package_order, /json/link_order, /json/abort_link) allows low-privileged users to perform unauthorized MODIFY operations that violate the application's permission model. Versions prior to 0.5.0b3.dev97 are affected; the vulnerability requires valid authentication but enables privilege boundary bypass without requiring elevated credentials.

Technical ContextAI

pyLoad is a Python-based download manager that implements a permission-based access control model to restrict user actions based on privilege levels. The vulnerability exists in the WebUI JSON API layer, where three specific endpoints fail to enforce the same authorization checks that the underlying core API methods require. This represents a classic authorization bypass (CWE-863: Incorrect Authorization) where client-facing API endpoints do not properly validate user privileges before delegating to protected operations. The permission enforcement gap allows authenticated users with lower privilege levels to invoke operations restricted to higher-privilege users, bypassing the application's intended authorization boundaries.

RemediationAI

Upgrade pyLoad to version 0.5.0b3.dev97 or later, which includes the authorization enforcement fix for the vulnerable JSON endpoints. Users unable to upgrade immediately should restrict network access to pyLoad's WebUI to trusted networks only, or disable the affected endpoints if they are not required for normal operations. Review access logs for any suspicious activity from low-privileged accounts targeting /json/package_order, /json/link_order, or /json/abort_link endpoints. The vendor advisory at https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwm contains additional context and upgrade instructions.