Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1044

NIXPKGS-2026-1044
published on
Permalink CVE-2026-40071
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 2 weeks, 4 days ago by @LeSuisse Activity log
  • Created suggestion 2 weeks, 5 days ago
  • @LeSuisse ignored
    5 packages
    • tests.home-assistant-component-tests.pyload
    • home-assistant-component-tests.pyload
    • python314Packages.pyloadapi
    • python313Packages.pyloadapi
    • python312Packages.pyloadapi
    2 weeks, 4 days ago
  • @LeSuisse accepted 2 weeks, 4 days ago
  • @LeSuisse published on GitHub 2 weeks, 4 days ago
pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. This vulnerability is fixed in 0.5.0b3.dev97.

Affected products

pyload
  • ==< 0.5.0b3.dev97

Matching in nixpkgs

Ignored packages (5)

Package maintainers