Insufficient Session Expiration

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Insufficient Session Expiration via the changepassword, removeuser, and setuserpermission API methods, which fail to invalidate existing web sessions when a...

Insufficient Session Expiration

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Insufficient Session Expiration via the changepassword, removeuser, and setuserpermission API methods, which fail to invalidate existing web sessions when a...

pyLoad: Api.set_user_permission never invalidates the target's session

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...