CVE-2026-123813

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

CVE-2026-123813 pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

EUVD-2026-120449

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

CVE-2026-123813

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

CVE-2026-123813

The open-source download manager pyLoad (versions prior to 0.5.0b3.dev102 ) contains a vulnerability where it fails to invalidate existing Flask sessions when an administrator changes a user's permissions or password via the /api/set_user_permission or /api/change_password endpoints. The root cau...

CVE-2026-123813: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

PT-2026-141132

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102 Description pyLoad fails to invalidate active Flask sessions when an administrator modifies a user's password or permissions. This occurs because the system uses role and permission values copied into th...

SUSE-SU-2026:22023-1 Security update for python-Flask

This update for python-Flask fixes the following issue: - CVE-2026-27205: information disclosure due to Flask session not adding the Vary: Cookie header bsc1258700...