CVE-2026-46645 (GCVE-0-2026-46645)

Vulnerability from cvelistv5 – Published: 2026-06-10 22:23 – Updated: 2026-06-11 16:14
VLAI
Title
SQLAdmin: Authorization Bypass on `ajax_lookup`
Summary
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-11 14:49 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
smithyhq sqladmin Affected: < 0.25.1
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46645",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:49:02.169261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T16:14:04.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sqladmin",
          "vendor": "smithyhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.25.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model\u0027s data through the ajax_lookup endpoint \u2014 silently bypassing the restriction. This issue has been patched in version 0.25.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T22:23:57.397Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj"
        },
        {
          "name": "https://github.com/smithyhq/sqladmin/pull/1035",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/smithyhq/sqladmin/pull/1035"
        },
        {
          "name": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"
        },
        {
          "name": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1"
        }
      ],
      "source": {
        "advisory": "GHSA-54mc-gghv-4cfj",
        "discovery": "UNKNOWN"
      },
      "title": "SQLAdmin: Authorization Bypass on `ajax_lookup`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46645",
    "datePublished": "2026-06-10T22:23:57.397Z",
    "dateReserved": "2026-05-15T20:11:54.584Z",
    "dateUpdated": "2026-06-11T16:14:04.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46645",
      "date": "2026-09-25",
      "epss": "0.00367",
      "percentile": "0.27912"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "sqladmin",
                "vendor": "smithyhq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.25.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model\u0027s data through the ajax_lookup endpoint \u2014 silently bypassing the restriction. This issue has been patched in version 0.25.1."
          },
          {
            "lang": "es",
            "value": "SQLAdmin es una interfaz de administraci\u00f3n flexible para modelos de SQLAlchemy. Antes de la versi\u00f3n 0.25.1, el endpoint ajax_lookup en application.py omite la verificaci\u00f3n de control de acceso is_accessible() que todos los dem\u00e1s endpoints aplican. Si un desarrollador restringe el acceso a un modelo al sobrescribir is_accessible(), un usuario autenticado a\u00fan puede consultar los datos de ese modelo a trav\u00e9s del endpoint ajax_lookup - eludiendo silenciosamente la restricci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 0.25.1."
          }
        ],
        "id": "CVE-2026-46645",
        "lastModified": "2026-07-23T09:10:00.113",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-46645",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:49:02.169261Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-10T23:16:47.310",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/smithyhq/sqladmin/pull/1035"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-46645",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-11T14:49:02.169261Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-11T14:49:10.749Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "sqladmin",
              "vendor": "smithyhq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.25.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model\u0027s data through the ajax_lookup endpoint \u2014 silently bypassing the restriction. This issue has been patched in version 0.25.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-10T22:23:57.397Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj"
            },
            {
              "name": "https://github.com/smithyhq/sqladmin/pull/1035",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/smithyhq/sqladmin/pull/1035"
            },
            {
              "name": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"
            },
            {
              "name": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1"
            }
          ],
          "source": {
            "advisory": "GHSA-54mc-gghv-4cfj",
            "discovery": "UNKNOWN"
          },
          "title": "SQLAdmin: Authorization Bypass on `ajax_lookup`"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-46645",
        "datePublished": "2026-06-10T22:23:57.397Z",
        "dateReserved": "2026-05-15T20:11:54.584Z",
        "dateUpdated": "2026-06-11T16:14:04.832Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.