CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - Bypass de Autorización en ajaxlookup de SQLAdmin Resumen Ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir CVE-2026-46645, una vulnerabilidad de bypass de autorización que afecta al endpoint ajaxlookup de SQLAdmin. SQLAdmin es una interfaz de...

CVE-2026-54529

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

EUVD-2026-77581

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529

SQLAdmin , a Python admin interface for SQLAlchemy models, is vulnerable to an information-exposure ordering oracle via the unvalidated sortBy query parameter in ModelView.sort_query() (prior to 0.27.1 ). The root cause is that column_sortable_list is enforced only in the frontend template to dec...

CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

PYSEC-2026-3922 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SummaryModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

GHSA-CCG5-9C8W-XH6V SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

PYSEC-2026-3073 SQLAdmin: Authorization Bypass on `ajax_lookup`

Impact The ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user can still query that model's data through the ajaxlookup endpoint — silently...

Exploit for CVE-2026-46645

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass...

CVE-2026-46645

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

CVE-2026-46645 SQLAdmin: Authorization Bypass on `ajax_lookup`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

CVE-2026-46645

SQLAdmin (for SQLAlchemy) contains an authorization bypass in the ajax_lookup endpoint prior to version 0.25.1, where is_accessible() is bypassed, allowing an authenticated user to query a model’s data despite access restrictions. The issue affects ajax_lookup specifically and was mitigated by pa...

EUVD-2026-36168

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

CVE-2026-46645 SQLAdmin: Authorization Bypass on `ajax_lookup`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

Missing Authorization

Overview sqladmin is a SQLAlchemy admin for FastAPI and Starlette Affected versions of this package are vulnerable to Missing Authorization in the ajaxlookup endpoint due to missing enforcement of access control checks. An attacker can access restricted model data by sending requests to the...

GHSA-54MC-GGHV-4CFJ SQLAdmin: Authorization Bypass on `ajax_lookup`

Impact The ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user can still query that model's data through the ajaxlookup endpoint — silently...