pyLoad: Api.set_user_permission never invalidates the target's session

{
  "id": "4b3d585b92068cf83b598ede94e94192cd6fdc8e56ecc588574e06205effc13b",
  "url": "https://osv.dev/vulnerability/GHSA-889w-m37p-88m5",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "pyLoad: Api.set_user_permission never invalidates the target's session",
    "summary": "### Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented `/api/` RPC surface — e.g. `POST /api/set_user_permission` (or its legacy alias `/api/setUserPermission`) — updates the target's database row but never invalidates that user's existing Flask cookie session. The demoted user keeps their pre-revocation `role`/`permission` bits on every subsequent WebUI page load and every subsequent `/api/` call made with that cookie, for up to the default `session_lifetime` of ~31 days, or until they voluntarily log out. No action by the demoted user is required beyond already being logged in at the time of revocation. ### Details The vulnerable method, verbatim, at `src/pyload/core/api/__init__.py:1652-1656`: ``` @legacy(\"setUserPermission\") @post def set_user_permission(self, user: str, permission: int, role: int) -> None: self.pyload.db.set_permission(user, permission) self.pyload.db.set_role(user, role) ``` It carries no `@permission(...)` decorator and its body never calls `clear_all_user_sessions` or any other session-invalidation routine. The **only** call site in the entire codebase that pairs a permission/role change with `clear_all_user_sessions` is the WebUI's `update_users()` route, `src/pyload/webui/app/blueprints/json_blueprint.py:442-444`: ``` api.set_user_permission(name, data[\"permission\"], data[\"role\"]) if was_changed: clear_all_user_sessions(name) ``` A repo-wide grep for `set_user_permission|setUserPermission` retur",
    "evidence": "osv:GHSA-889w-m37p-88m5",
    "products": [
      {
        "name": {
          "value": "pyload-ng",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.5.0b3.dev100",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.0b3.dev101",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.0b3.dev98",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.0b3.dev99",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-889w-m37p-88m5",
      "aliases": [
        "GHSA-889w-m37p-88m5"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0.5.0b3.dev98"
                },
                {
                  "last_affected": "0.5.0b3.dev101"
                }
              ]
            }
          ],
          "package": {
            "name": "pyload-ng",
            "purl": "pkg:pypi/pyload-ng",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.5.0b3.dev100",
            "0.5.0b3.dev101",
            "0.5.0b3.dev98",
            "0.5.0b3.dev99"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-889w-m37p-88m5/GHSA-889w-m37p-88m5.json"
          }
        }
      ],
      "modified": "2026-10-09T17:15:04.764371508Z",
      "provider": "osv",
      "references": [
        "https://github.com/pyload/pyload/security/advisories/GHSA-889w-m37p-88m5",
        "https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad",
        "https://github.com/pyload/pyload"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-613"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-09T17:09:07Z"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 122366,
  "published_at": "2026-10-09T17:09:07+00:00"
}