SQLAdmin: Authorization Bypass on `ajax_lookup`
Impact
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=<field>&term=<query>
All other endpoints enforce both checks:
| Endpoint | @login_required |
is_accessible() |
|---|---|---|
list |
✓ | ✓ |
create |
✓ | ✓ |
edit |
✓ | ✓ |
delete |
✓ | ✓ |
details |
✓ | ✓ |
export |
✓ | ✓ |
ajax_lookup (before fix) |
✗ | ✗ |
ajax_lookup (after fix) |
✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Patches
Two changes were made to ajax_lookup:
- Replaced the hand-rolled authentication check added in #1035 with the standard
@login_requireddecorator used by all other endpoints. - Added the missing
is_accessible(request)check, raisingHTTP 403when it returnsFalse.
Workarounds
None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | sqladmin | < 0.25.1 | 0.25.1 |
Referencias
- https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj
- https://nvd.nist.gov/vuln/detail/CVE-2026-46645
- https://github.com/smithyhq/sqladmin/pull/1035
- https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98
- https://github.com/smithyhq/sqladmin
- https://github.com/smithyhq/sqladmin/releases/tag/0.25.1
- https://pypi.org/project/sqladmin
- https://github.com/advisories/GHSA-54mc-gghv-4cfj
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Debilidad (CWE)
CWE-862- Plataforma
- Python (PyPI)
- Paquete
sqladmin- Publicada
- 21.05.2026
- Actualizado
- 11.10.2026 14:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-3073 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-54mc-gghv-4cfj - CC BY 4.0
Historial de vulnerabilidades: sqladmin
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 05.2026 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 2
Divulgaciones por año
- 2026: 2
-
SQLAdmin: Authorization Bypass on `ajax_lookup` esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.