CVE-2026-123813

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102

Description pyLoad fails to invalidate active Flask sessions when an administrator modifies a user's password or permissions. This occurs because the system uses role and permission values copied into the session during login via the set session() function in webui/app/helpers.py, rather than verifying them against the database for every request. Consequently, a user may retain revoked privileges or maintain access using a session established with an old password for the duration of the session lifetime, which defaults to 44640 minutes.

This issue is triggered when using the following API endpoints:

Authentication via API keys is not affected as it retrieves user data directly from the database for each request.

Recommendations Update pyLoad to version 0.5.0b3.dev102 or later.