{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.0b3.dev101"}],"component":"pyload-ng","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jq7h-wrvp-3rgx","id":"tcs_01M5KFPDA34KA1CJ8DY66ND718","modified_at":"2026-10-09T17:15:04.487483434Z","published_at":"2026-10-09T17:09:09Z","references":["https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx","https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx","https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad","https://github.com/pyload/pyload"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jq7h-wrvp-3rgx","url":"https://osv.dev/vulnerability/GHSA-jq7h-wrvp-3rgx"}],"summary":"pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session"}