SQLAdmin: Authorization Bypass on `ajax_lookup`
Impact
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=<field>&term=<query>
All other endpoints enforce both checks:
| Endpoint | @login_required |
is_accessible() |
|---|---|---|
list |
✓ | ✓ |
create |
✓ | ✓ |
edit |
✓ | ✓ |
delete |
✓ | ✓ |
details |
✓ | ✓ |
export |
✓ | ✓ |
ajax_lookup (before fix) |
✗ | ✗ |
ajax_lookup (after fix) |
✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Patches
Two changes were made to ajax_lookup:
- Replaced the hand-rolled authentication check added in #1035 with the standard
@login_requireddecorator used by all other endpoints. - Added the missing
is_accessible(request)check, raisingHTTP 403when it returnsFalse.
Workarounds
None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sqladmin | < 0.25.1 | 0.25.1 |
References
- https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj
- https://nvd.nist.gov/vuln/detail/CVE-2026-46645
- https://github.com/smithyhq/sqladmin/pull/1035
- https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98
- https://github.com/smithyhq/sqladmin
- https://github.com/smithyhq/sqladmin/releases/tag/0.25.1
- https://pypi.org/project/sqladmin
- https://github.com/advisories/GHSA-54mc-gghv-4cfj
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-862- Platform
- Python (PyPI)
- Package
sqladmin- Disclosed
- 21.05.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3073 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-54mc-gghv-4cfj - CC BY 4.0
Vulnerability history: sqladmin
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 05.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2026: 2
-
SQLAdmin: Authorization Bypass on `ajax_lookup` this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.