GHSA-rfgh-63mg-8pwm: pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

April 8, 2026

Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad’s own permission model.

Confirmed mismatches:

ADD user can reorder packages/files (order_package, order_file) via /json/package_order and /json/link_order
DELETE user can abort downloads (stop_downloads) via /json/abort_link

References

github.com/advisories/GHSA-rfgh-63mg-8pwm
github.com/pyload/pyload
github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwm

Code Behaviors & Features

Detect and mitigate GHSA-rfgh-63mg-8pwm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →