CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - Bypass de Autorización en ajaxlookup de SQLAdmin Resumen Ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir CVE-2026-46645, una vulnerabilidad de bypass de autorización que afecta al endpoint ajaxlookup de SQLAdmin. SQLAdmin es una interfaz de...

SQLAdmin: Authorization Bypass on `ajax_lookup`

ImpactThe ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce.If a developer restricts model access by overriding isaccessible, an authenticated user can still query that model's data through the ajaxlookup endpoint — silently...

CVE-2026-46645

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajaxlookup endpoint in application.py bypasses the isaccessible access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible, an authenticated user...