Vulnerable code sample

import collections

# Simplified representation of permissions for the demonstration.
Perms = collections.namedtuple("Perms", ["SETTINGS", "ADMIN"])(
    "SETTINGS", "ADMIN"
)

# Simplified representation of pyLoad's core configuration state.
config = {
    "general": {
        "ssl_verify": True,
        "secret_key": "sensitive_default_value",
    }
}

# The incomplete list of options requiring admin privileges.
# The vulnerability is the omission of ("general", "ssl_verify").
ADMIN_ONLY_CORE_OPTIONS = [
    ("general", "secret_key"),
    # Other sensitive options would be here...
]

def set_config_value(user, section, option, value):
    """
    Simplified representation of the vulnerable API method from
    src/pyload/core/api/__init__.py. The real method is decorated with
    @permission(Perms.SETTINGS), which is simulated here by the initial check.
    """
    # This check simulates the @permission(Perms.SETTINGS) decorator.
    if not user.has_permission(Perms.SETTINGS):
        # In a real API, this would raise an exception or return an error.
        return False

    config_tuple = (section, option)

    # Check if the option requires admin privileges.
    if config_tuple in ADMIN_ONLY_CORE_OPTIONS:
        if not user.has_permission(Perms.ADMIN):
            # Deny non-admins from changing these specific options.
            return False

    # VULNERABILITY: Since ("general", "ssl_verify") is not in the
    # ADMIN_ONLY_CORE_OPTIONS list, the check above is bypassed.
    # Any user with SETTINGS permission can change its value, disabling
    # SSL verification for all subsequent requests.
    if section in config and option in config[section]:
        config[section][option] = value
        return True
        
    return False