pyLoad versions through 0.5.0b3.dev97 cache the user’s role and permissions in the session at login. When an administrator later changes a user’s role or permissions in the database, the cached values remain in the session and continue to be used for authorization, allowing the user to maintain revoked privileges until the session ends or the user logs out. This flaw is a core authorization and session consistency issue, classified as CWE-613.

The pyLoad download manager, vendor pyload:pyload, is affected by this bug in all releases up to and including 0.5.0b3.dev97. Users relying on earlier roles and permissions can retain those privileges after an update to their account in the database.

The CVSS score of 8.8 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who has an active session prior to a role or permission change can exploit the stale session data to perform privileged actions without re‑authenticating. Although no public exploit is currently documented, the high severity and the fact that the flaw persists until logout make it a significant risk for environments where role changes occur frequently.