pyload-ng version prior to 0.5.0b3.dev97 has a permission mismatch vulnerability in its WebUI JSON endpoints. These endpoints enforce weaker permissions than the underlying core API methods, allowing authenticated users with ADD or DELETE permissions to perform MODIFY-level actions such as reordering packages/files and aborting downloads. This bypasses intended permission boundaries in the application.