p PatchFirst

CVE-2026-46645

CVE-2026-46645 · SQLAdmin: Authorization Bypass on `ajax_lookup`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

CVSS 4.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • sqladmin

    Versions
    • < 0.25.1: Affected

    No fix published

  • sqladmin PyPI

    Versions
    • 0.0.0
    • 0.1.0
    • 0.1.1
    • 0.1.10
    • 0.1.11
    • 0.1.12
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.1.6
    • 0.1.7
    • 0.1.8
    • 0.1.9
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.15.1
    • 0.15.2
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.18.0
    • 0.19.0
    • 0.2.0
    • 0.2.1
    • 0.20.0
    • 0.20.1
    • 0.21.0
    • 0.22.0
    • 0.23.0
    • 0.24.0
    • 0.25.0
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.7.0
    • 0.8.0
    • 0.9.0
    Affected ranges
    • ECOSYSTEM: < 0.25.1

    Update to 0.25.1

Original sources

Check your server →