pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

PT-2026-117588

Summary Api.getUserData legacy and Api.get userdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/get userdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...