Pyload ng: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

In pyLoad-ng up to version 0.5.0b3.dev101, administrative actions performed through the REST API endpoints /api/set_user_permission and /api/change_password update the database but do not invalidate the affected user's existing session. The Flask session stores role and permission data at login, and subsequent requests read these cached values rather than querying the database. Consequently, a demoted user's session remains active with old privileges, and a password change does not terminate the previous session. The issue does not affect API key authentication, which reads user data from the database on every request. The default session lifetime is approximately 31 days, allowing stale sessions to persist for a significant duration. The problem arises because session invalidation is only implemented in certain WebUI form handlers, not in the core API methods.

An attacker or user whose privileges are revoked or whose password is changed via the REST API can continue to use their existing session with the previous privileges until the session expires or is manually invalidated. This can lead to unauthorized access to administrative functions and sensitive operations for up to about a month. The vulnerability undermines the effectiveness of privilege revocation and password rotation as security controls in affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid using the REST API endpoints /api/set_user_permission and /api/change_password for privilege revocation or password changes, and instead use the WebUI form handlers (/json/update_users and /json/change_password) which properly invalidate sessions. Alternatively, manual session invalidation or reducing session lifetime may mitigate risk. The recommended fix is to invalidate user sessions immediately after database updates in the core API methods to ensure all callers enforce updated permissions.