Pyload ng: pyLoad: Api.set_user_permission never invalidates the target's session

The vulnerability in pyLoad-ng arises from the API method Api.set_user_permission, which updates a user's permissions and roles in the database but does not invalidate or clear the user's existing Flask session cookie. Consequently, if an admin downgrades a user's permissions via the documented /api/set_user_permission RPC endpoint, the user's session still reflects their old permissions until the session expires or the user logs out. The session data is set only at login and is never refreshed during the session lifetime (~31 days). Authorization checks rely on the session's cached role and permission bits, allowing the demoted user to retain elevated access temporarily. The vulnerability is present in versions >=0.5.0b3.dev98 and <=0.5.0b3.dev101. No direct patch or fix is indicated in the provided data.

A non-admin user who is demoted by an admin through the API retains their previous elevated permissions in their active session cookie for up to approximately 31 days or until they log out. This allows the demoted user to continue accessing privileged functionality during this window, potentially leading to unauthorized access or actions. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware that revoking or downgrading user permissions via the API does not immediately revoke active sessions. As a workaround, affected users should be forced to log out or have their sessions manually invalidated if possible. Monitoring and restricting use of the /api/set_user_permission endpoint to trusted admins only is recommended.