PT-2026-42694 · Sqladmin · Sqladmin

CVE-2026-46645 · Published 2026-05-21 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQLAdmin versions prior to 0.25.1

Description The ajax lookup endpoint in application.py bypasses the is accessible() access control check enforced by other endpoints. If a developer restricts model access by overriding is accessible(), an authenticated user can query that model's data through the GET /{identity}/ajax/lookup?name=<field>&term=<query> endpoint, silently bypassing the restriction.

Recommendations Update to version 0.25.1.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-46645

GHSA-54MC-GGHV-4CFJ

PYSEC-2026-3073

Affected Products

Sqladmin

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46645.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-46645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46645 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-3073 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54mc-gghv-4cfj · Vendor Advisory
• https://github.com/smithyhq/sqladmin · Note
• https://github.com/smithyhq/sqladmin/releases/tag/0.25.1 · Note
• https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj · Note
• https://github.com/smithyhq/sqladmin/pull/1035 · Note
• https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98 · Note
• https://pypi.org/project/sqladmin · Note
• https://t.me/cveNotify/166975 · Telegram Post
• https://t.me/CVEtracker/56512 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2064996984918888726 · Twitter Post
• https://github.com/advisories/GHSA-54mc-gghv-4cfj · Note