33 matches found
CVE-2026-46645-Analysis-Lab
CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass Executive Summary This repository contains a local Docker lab for reproducing CVE-2026-46645, an authorization bypass vulnerability affecting SQLAdmin's ajaxlookup endpoint. SQLAdmin is an admin interface for SQLAlchemy models in Starlette...
CVE-2026-54529
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
EUVD-2026-77581
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
arpakitlib (>=1.9.5, <=1.9.51), blog-coeur (>=0.0.14, <=0.0.19) +7 more potentially affected by CVE-2026-54529 via sqladmin (>=0.5.0, <=0.26.0)
sqladmin PYPI version =0.5.0, =1.9.5, =0.0.14, =0.0.1, =0.0.17, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54529 Source advisory: MEND:CVE-2026-54529...
CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
CVE-2026-54529
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
CVE-2026-54529
SQLAdmin , a Python admin interface for SQLAlchemy models, is vulnerable to an information-exposure ordering oracle via the unvalidated sortBy query parameter in ModelView.sort_query() (prior to 0.27.1 ). The root cause is that column_sortable_list is enforced only in the frontend template to dec...
CVE-2026-54529: Improper Input Validation
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...
arpakitlib (>=1.9.5, <=1.9.51), blog-coeur (>=0.0.14, <=0.0.19) +7 more potentially affected by CVE-2026-54529 via sqladmin (>=0.5.0, <=0.26.0)
sqladmin PYPI version =0.5.0, =1.9.5, =0.0.14, =0.0.1, =0.0.17, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54529 Source advisory: OSV:PYSEC-2026-3922...
PYSEC-2026-3922 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...
SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
SummaryModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...
SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...
GHSA-CCG5-9C8W-XH6V SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...
arpakitlib (>=1.9.5, <=1.9.51), blog-coeur (>=0.0.14, <=0.0.19) +7 more potentially affected by CVE-2026-54529 via sqladmin (>=0.5.0, <=0.26.0)
sqladmin PYPI version =0.5.0, =1.9.5, =0.0.14, =0.0.1, =0.0.17, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54529 Source advisory: GHSA-CCG5-9C8W-XH6V...
arpakitlib (>=1.9.5, <=1.9.51), blog-coeur (>=0.0.14, <=0.0.19) +7 more potentially affected by CVE-2026-54529 via sqladmin (>=0.5.0, <=0.26.0)
sqladmin PYPI version =0.5.0, =1.9.5, =0.0.14, =0.0.1, =0.0.17, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54529 Source advisory: OSV:GHSA-CCG5-9C8W-XH6V...
arpakitlib (>=1.9.5, <=1.9.50), blog-coeur (>=0.0.14, <=0.0.19) +7 more potentially affected by CVE-2026-46645 via sqladmin (>=0.5.0, <=0.22.0)
sqladmin PYPI version =0.5.0, =1.9.5, =0.0.14, =0.0.1, =0.0.17, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-46645 Source advisory: OSV:PYSEC-2026-3073...
PYSEC-2026-3073 SQLAdmin: Authorization Bypass on `ajax_lookup`
Impact The ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user can still query that model's data through the ajaxlookup endpoint — silently...
