Read the docs
TI-2026-34296 Aliases CVE-2026-46645GHSA-54mc-gghv-4cfj

SQLAdmin: Authorization Bypass on `ajax_lookup`

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed sqladmin (smithyhq): 0.25.1sqladmin (PyPI): 0.25.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
smithyhqsqladminbefore 0.25.10.25.1Patch availableCNA
—sqladmin (PyPI)before 0.25.10.25.1Patch availableGHSA-54mc-gghv-4cfj
  • sqladmin Vendorsmithyhq Affected before 0.25.1 Fixed in 0.25.1 Patch available CNA
  • sqladmin (PyPI) Vendor— Affected before 0.25.1 Fixed in 0.25.1 Patch available GHSA-54mc-gghv-4cfj

Remediation

  • Fix · CNA sqladmin (smithyhq) Fixed in 0.25.1
  • Fix · GHSA-54mc-gghv-4cfj sqladmin (PyPI) Fixed in 0.25.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46645
  2. 2026-10-03 Alias added: GHSA-54mc-gghv-4cfj

References

Advisory 1

Other 5

  • TI-2026-39374 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list` CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences