Skip to content
Threat Feed
Subscribe

Product

PyLoad (All Versions Prior to Fix)

1 brief RSS
high advisory

pyLoad Session Invalidation Failure After Privilege Revocation

An improper implementation of the set_user_permission API endpoint in pyLoad allows users to retain elevated permissions for up to 31 days after an administrator has explicitly revoked their access.

pyLoad privilege-escalation persistence api-security
1t