{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.5.0b3.dev98"}],"component":"pyload-ng","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-889w-m37p-88m5","id":"tcs_01M5KF7PJSGRN0GAFK2RRKP1QD","modified_at":"2026-10-09T17:15:04.764371508Z","published_at":"2026-10-09T17:09:07Z","references":["https://osv.dev/vulnerability/GHSA-889w-m37p-88m5","https://github.com/pyload/pyload/security/advisories/GHSA-889w-m37p-88m5","https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad","https://github.com/pyload/pyload"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-889w-m37p-88m5","url":"https://osv.dev/vulnerability/GHSA-889w-m37p-88m5"}],"summary":"pyLoad: Api.set_user_permission never invalidates the target's session"}