The vulnerability in pyLoad’s configuration handling stems from a mismatch in the option names used in the admin‑only authorization check. The check references ssl_cert and ssl_key, while the correct configuration options are ssl_certfile and ssl_keyfile; consequently, the check always fails. As a result, any user granted SETTINGS permission can alter the SSL certificate and key file paths in the software’s configuration, effectively bypassing the intended admin restriction. This can allow an attacker to supply a forged certificate or redirect secure traffic to a malicious endpoint, exposing sensitive data or enabling man‑in‑the‑middle attacks.

The issue affects all installations of pyLoad version 0.5.0b3.dev96 and earlier. Users running the 0.5.0b3.dev97 release or later are not impacted, as the patch corrects the option names in the authorization set. The vulnerability is limited to the pyLoad download manager and its upstream maintenance branch under the pyload:pyload CNA.

The CVSS base score of 6.8 reflects a moderate severity due to the compromise of configuration integrity. Because the bypass is tied to the SETTINGS permission, attackers must first obtain at least that level of access to the pyLoad instance; no external network exploit is required beyond the normal privileged actions. EPSS data is unavailable, and the vulnerability is not presently listed in CISA’s KEV catalog. In typical deployment scenarios, an intruder with local or trusted remote access to the web interface or backend services is capable of changing the certificate paths and could be leveraged to facilitate man‑in‑the‑middle attacks or downgrade SSL, posing a significant confidentiality risk.