The vulnerability exists in pyLoad’s set_config_value API, which exposes the ssl_verify setting to users with the SETTINGS permission. By setting general.ssl_verify to off, these users can globally disable SSL/TLS peer verification for all outbound pycurl requests. This removes certificate checks and allows an attacker who can position themselves on the network path to present forged certificates, enabling a man‑in‑the‑middle attack that can compromise confidentiality, integrity and potentially availability of the downloaded content. The flaw is rooted in CWE‑295, CWE‑306 and CWE‑863.

All installations of pyLoad older than version 0.5.0b3.dev100 are affected. The issue does not require elevated privileges beyond a normal authenticated user with the SETTINGS role, so any user who has been granted that permission—whether intentionally or via credential compromise—can exploit the flaw. The affected product is the pyLoad download manager, both the core application and any components that perform outbound downloads.

The CVSS score of 6.8 represents a medium severity risk. The EPSS score is not available, so the current predicted exploitation probability is unknown. The vulnerability is not yet listed in the CISA KEV catalog. An attacker must first obtain authenticated access with SETTINGS permission; once gained, the vulnerability is straightforward to exploit by toggling ssl_verify and performing any outbound request that the user initiates. No privileged escalation is required beyond the existing authenticated session, and the attack can be carried out in an on‑path or intercepting environment to supply forged certificates.