CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass Краткое описание Данный репозиторий содержит локальную лабораторию Docker для воспроизведения CVE-2026-46645 — уязвимости обхода авторизации, затрагивающей конечную точку ajaxlookup SQLAdmin. SQLAdmin — это административный интерфейс для...

SQLAdmin: Authorization Bypass on `ajax_lookup`

ImpactThe ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce.If a developer restricts model access by overriding isaccessible, an authenticated user can still query that model's data through the ajaxlookup endpoint — silently...

CVE-2026-46645

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...

CVE-2026-46645: Missing Authorization

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...