https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T23:00:42.446150+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46645 CVE-2026-46645 — SQLAdmin: Authorization Bypass on `ajax_lookup` 2026-10-09T23:00:42.447798+00:00

Affected: smithyhq sqladmin

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

 https://cve.radiocsirt.org/vuln/ghsa-54mc-gghv-4cfj GHSA-54mc-gghv-4cfj — SQLAdmin: Authorization Bypass on `ajax_lookup` 2026-10-09T23:00:42.447856+00:00

Affected: PyPI: sqladmin

### Impact

The `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all other endpoints enforce.

If a developer restricts model access by overriding `is_accessible()`, an authenticated user can still query that model's data through the `ajax_lookup` endpoint — silently bypassing the restriction.

**Affected endpoint:**

`GET /{identity}/ajax/lookup?name=<field>&term=<query>`

**All other endpoints enforce both checks:**

| Endpoint | `@login_required` | `is_accessible()` | |---|---|---| | `list` | ✓ | ✓ | | `create` | ✓ | ✓ | | `edit` | ✓ | ✓ | | `delete` | ✓ | ✓ | | `details` | ✓ | ✓ | | `export` | ✓ | ✓ | | `ajax_lookup` (before fix) | ✗ | ✗ | | `ajax_lookup` (after fix) | ✓ | ✓ |

Note: before this fix, `ajax_lookup` also lacked the `@login_required` decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.

### Patches

Two changes were made to `ajax_lookup`:

1. Replaced the hand-rolled authentication check added in #1035 with the standard `@login_required` decorator used by all other endpoints. 2. Added the missing `is_accessible(request)` check, raising `HTTP 403` when it returns `False`.

### Workarounds

None. Developers relying on `is_accessible()` to restrict model visibility are exposed regardless of what other access controls are in place.