Threats Tagged 'ghsa-889w-m37p-88m5'
View all threats tagged with 'ghsa-889w-m37p-88m5'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-889w-m37p-88m5'
Click on any threat for detailed analysis and mitigation recommendations
pyLoad-ng contains a vulnerability where an admin revoking or downgrading a non-admin user's permissions via the documented API does not invalidate the user's existing Flask session cookie. As a result, the demoted user retains their previous elevated permissions in their session for up to the session lifetime (~31 days) or until they log out. This stale session issue occurs because the API method that changes permissions does not clear or refresh user sessions, and no mechanism exists to update session data after login. The vulnerability affects versions from 0.5.0b3.dev98 through 0.5.0b3.dev101 and has a CVSS score of 7.5 (high severity). Join the discussion | GCVE Database | 10/09/2026, 17:09:07 UTC Added: 10/09/2026, 22:44:49 UTC |
Showing 1 to 1 of 1 result