pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

The pyload-ng API exposes two endpoints, getUserData and get_userdata, which are annotated with @permission(Perms.ANY). Since Perms.ANY equals zero and the permission check uses a bitmask AND operation, this gate always returns true for any authenticated user, including those with zero permissions. These endpoints wrap the check_auth() method, which is intended to be admin-only, effectively undoing its protection. An attacker with a low-privileged account can use these endpoints as a binary oracle to brute-force the administrator password. There is no account lockout mechanism, and the rate limiting based on the X-Forwarded-For header is easily bypassed by rotating this header. This vulnerability was verified on version 0.5.0b3 and allows an attacker to recover the admin password and gain full administrative access.

An attacker with any authenticated account can perform an online brute-force attack against the administrator password without triggering lockout or effective rate limiting, due to the flawed permission check and bypassable rate limiting. Successful exploitation leads to full administrative takeover and disclosure of sensitive administrator account details such as id, name, email, role, and permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoints getUserData and get_userdata to trusted users only, and consider implementing external rate limiting and monitoring for unusual authentication attempts. Avoid relying on the X-Forwarded-For header for rate limiting without validation.