pyload-ng EUVD-2026-29120

The following conditions must be met for exploitation: (1) The target must be running pyload-ng version 0.5.0b3.dev99 or earlier. (2) The attacker must be authenticated to pyload and hold a role that includes the SETTINGS permission (verified by the @permission(Perms.SETTINGS) decorator on set_config_value). (3) The attacker's role must NOT be an admin (confirmed by the 'not is_admin' check in the allowlist logic); admin users already have full config access and are out of scope for this escalation. (4) The attacker must have network-level MITM capability (AV:N/AC:H reflects this: on-path interception is required). (5) No special configuration is required on pyload itself - the vulnerability exists in all deployments with multi-user access and delegated SETTINGS permissions. (6) Exploitation takes effect immediately on the next outbound HTTP request; no pyload restart is required because get_options() is called per-request.

CVSS 6.8 with AV:N/AC:H/PR:L indicates network-accessible exploitation requiring low privileges and high attack complexity. The high complexity reflects the requirement for an on-path attacker position (network interception capability), which is realistic in shared LAN, compromised router, DNS hijacking, or malicious proxy scenarios - particularly relevant given pyload-ng's use case as a download manager often running on home networks where users may share gateway hardware. EPSS and KEV status are not provided in the input data; however, this vulnerability should be considered HIGH PRIORITY because: (1) it directly chains with the published SSRF fixes (CVE-2026-33992, CVE-2026-35459), rendering hostname validation meaningless; (2) it represents a privilege escalation from delegated settings management to full TLS policy control; (3) exploitation requires only API calls with no UI interaction; (4) it is the fifth variant of the same root cause (incomplete allowlist), indicating the core authorization design is fundamentally broken and likely to spawn additional bypasses. The CVSS complexity adjustment for on-path requirements is realistic but should not be understated - home networks and cloud deployments with shared infrastructure are high-risk scenarios. The impact on confidentiality and integrity is confirmed by the PoC: silent MITM on all outbound HTTPS without logging or admin notification.

An authenticated user with SETTINGS permission (e.g., a household member in a multi-user home setup granted 'manage settings' privileges by the admin) or a compromised account holding SETTINGS sends an authenticated POST request to /api/setConfigValue with parameters category=general, option=ssl_verify, value=off. The request succeeds without requiring admin credentials. Subsequently, when the admin (or any user) enqueues an HTTPS download, a co-located attacker on the same LAN or a compromised upstream router presents a forged TLS certificate; pyload accepts it because SSL_VERIFYPEER is now 0, and the download is silently MITM'd, potentially delivering malware, credentials, or falsified content. The attacker gains no log entries or admin notifications.