Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200, CWE-269 and CWE-863.
Summary
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| piccolo-orm | piccolo_admin | before 1.14.0 | 1.14.0 | Patch available | CNA |
| — | piccolo-admin (PyPI) | before 1.14.0 | 1.14.0 | Patch available | GHSA-2gh4-jmwq-rr8w |
- piccolo_admin Vendorpiccolo-orm Affected before 1.14.0 Fixed in 1.14.0 Patch available CNA
- piccolo-admin (PyPI) Vendor— Affected before 1.14.0 Fixed in 1.14.0 Patch available GHSA-2gh4-jmwq-rr8w
Remediation
- Fix · CNA piccolo_admin (piccolo-orm) Fixed in 1.14.0
- Fix · GHSA-2gh4-jmwq-rr8w piccolo-admin (PyPI) Fixed in 1.14.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55485
- 2026-10-03 Alias added: GHSA-2gh4-jmwq-rr8w
References
Other 7
- https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w
- https://github.com/piccolo-orm/piccolo_api/pull/331
- https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
- https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4
- https://github.com/piccolo-orm/piccolo_admin/releases/tag/1.14.0
- https://github.com/piccolo-orm/piccolo_api/releases/tag/1.10.0
- https://github.com/piccolo-orm/piccolo_admin
More piccolo-orm vulnerabilities
- TI-2023-25468 piccolo SQL Injection via named transaction savepoints CVSS 3.1CRITICAL 9.1
- TI-2024-19994 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page CVSS 3.1HIGH 7.7
- TI-2023-22277 Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-55485 · CVE Program
- CVE-2026-55485 · NVD
- FIRST EPSS
- GHSA-2gh4-jmwq-rr8w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences