GHSA-889W-M37P-88M5 pyLoad: Api.set_user_permission never invalidates the target's session

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...

PT-2026-117589

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/set user permission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...