CVE-2026-41133
Pyload ≤ 2026-04-13
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-41133 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Pyload Pyload. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41133 is an authorization vulnerability affecting pyLoad, a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache a user's `role` and `permission` values in the session upon login and continue to authorize subsequent requests using these cached values. This persists even after an administrator modifies the user's role or permissions in the database, allowing the user to retain previously granted privileges until logout or session expiry. The issue, classified under CWE-613 (Insufficient Session Expiration), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-22.
An attacker with low-privilege (PR:L) authenticated access over the network can exploit this if an administrator revokes or downgrades their role or permissions post-login. The attacker retains the ability to perform high-privilege actions, such as those requiring elevated roles, leading to high impacts on confidentiality, integrity, and availability. No user interaction is required, and exploitation is straightforward due to low attack complexity.
The GitHub security advisory (GHSA-66hx-chf7-3332) and associated commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 detail the fix, which resolves the session caching inconsistency. Security practitioners should update to a version incorporating this commit and consider forcing session invalidation or logout for users after permission changes as a workaround.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24574
Vulnerability Data
pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admin changes…
more
the user's role/permissions in the database. As a result, an already logged-in user can keep old (revoked) privileges until logout/session expiry, enabling continued privileged actions. This is a core authorization/session-consistency issue and is not resolved by toggling an optional security feature. Commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 contains a fix for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Automatic termination of inactive sessions and limits on connection duration shrink the window during which a hijacked or unattended authenticated session can be exploited.