Listen to this Post
This security vulnerability arises due to an architectural flaw in pyLoad’s API permission revocation mechanism, specifically involving cookie-based Flask sessions. When an administrative user modifies or downgrades a user’s permissions or role via the core API endpoint (such as `POST /api/set_user_permission` or its legacy alias), the underlying database record is successfully updated. However, pyLoad’s session-management implementation fails to invalidate or refresh the target user’s active Flask session cookie.
Because the Flask session caches the user’s role and permission bits locally upon initial login and lacks any middleware or request-level database synchronization hook to re-validate these fields, the demoted user retains their original pre-revocation privilege level for subsequent WebUI page loads and API requests. Consequently, an attacker or demoted user can continue to execute unauthorized privileged actions using their stale cookie for up to the configured session lifetime limit (approximately 31 days) or until they voluntarily log out, directly undermining role-based access control enforcement.
DailyCVE Form:
Platform: pyLoad
Version: <= 0.5.0b3.dev97
Vulnerability : Insufficient Session Expiration
Severity: High
date: 2026-04-15
Prediction: 2026-05-01
What Undercode Say
Bash Commands and Code
To inspect the vulnerable API method responsible for updating permissions without clearing active sessions, review the implementation located at src/pyload/core/api/__init__.py:
@legacy("setUserPermission")
@post
def set_user_permission(self, user: str, permission: int, role: int) -> None:
self.pyload.db.set_permission(user, permission)
self.pyload.db.set_role(user, role)
To run a verification check or integration test suite against the local development environment using Python virtual environments:
python3 -m venv /tmp/pyload-poc-venv /tmp/pyload-poc-venv/bin/pip install -U pip /tmp/pyload-poc-venv/bin/pip install -e ".[bash]" /tmp/pyload-poc-venv/bin/python -m pytest tests/integration/test_api.py -q
Exploit: (Educational Purposes!)
An authenticated attacker or a demoted user can exploit this behavior by preserving their original Flask session cookie obtained prior to the administrative revocation. The attack vector follows these logical phases:
1. The victim logs into the pyLoad WebUI normally, receiving a signed Flask session cookie containing elevated role and permission claim parameters.
2. An administrator executes a permission revocation against the victim using the core RPC endpoint (POST /api/set_user_permission) rather than the WebUI administrative interface. This updates the database entries for role and permissions but omits any call to clear_all_user_sessions().
3. The victim issues subsequent requests using their original, uninvalidated session cookie. The backend’s authentication helper routine decodes the cached session claims without verifying them against the live database records.
4. The authorization checks evaluate successfully against the stale privilege bits, permitting the demoted user to access restricted endpoints and resources indefinitely until session expiration or logout.
Protection: from this CVE
To protect against this vulnerability, upgrade pyLoad to version 0.5.0b3.dev98 or higher, where session clearing routines are properly integrated into permission modification endpoints.
From a code modification perspective, ensure that `clear_all_user_sessions(name)` is invoked directly inside `Api.set_user_permission` to invalidate cached tokens immediately upon modification:
@legacy("setUserPermission")
@post
def set_user_permission(self, user: str, permission: int, role: int) -> None:
self.pyload.db.set_permission(user, permission)
self.pyload.db.set_role(user, role)
clear_all_user_sessions(user)
Impact
Successful exploitation of this vulnerability results in unauthorized privilege persistence. Even after an administrator explicitly strips a user of administrative rights or sensitive functional permissions, the affected user maintains access to protected application features, administrative dashboards, and sensitive system directories through their unexpired session cookie, completely bypassing access control restrictions for an extended window of up to 31 days.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
