The vulnerability allows authenticated users with low privileges to perform MODIFY operations through the /json/package_order, /json/link_order, and /json/abort_link WebUI JSON endpoints. These endpoints enforce weaker permissions than the core API methods they call, permitting actions such as adding or deleting users that should be denied. This results in unauthorized modification of configuration and potentially access to protected resources. The weakness is a classic permission mismatch, identified as CWE‑863, and directly facilitates privilege escalation within the pyLoad system.

pyLoad users running versions prior to 0.5.0b3.dev97 are affected. The offending components are the three WebUI JSON endpoints that expose modify functionality. Any deployment of pyLoad before the stated patch contains the flaw.

The CVSS score of 5.4 indicates medium severity. Exploitation requires the attacker to be authenticated to the pyLoad WebUI, so the attack vector is internal or remote but limited to known users. No EPSS score is provided, and the flaw is not listed in the CISA KEV catalog. Because the flaw is limited to the WebUI and does not enable remote code execution, the risk is constrained to privilege escalation and data modification for authenticated users.