https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:00:40 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46645 <p><strong>Affected:</strong> smithyhq sqladmin</p> <p>SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model&#39;s data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.</p> <p><strong>Affected:</strong> smithyhq sqladmin</p> <p>SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model&#39;s data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-46645 https://cve.radiocsirt.org/vuln/ghsa-54mc-gghv-4cfj <p><strong>Affected:</strong> PyPI: sqladmin</p> <p>### Impact</p> <p>The `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all other endpoints enforce.</p> <p>If a developer restricts model access by overriding `is_accessible()`, an authenticated user can still query that model&#39;s data through the `ajax_lookup` endpoint — silently bypassing the restriction.</p> <p>**Affected endpoint:**</p> <p>`GET /{identity}/ajax/lookup?name=&lt;field&gt;&amp;term=&lt;query&gt;`</p> <p>**All other endpoints enforce both checks:**</p> <p>| Endpoint | `@login_required` | `is_accessible()` | |---|---|---| | `list` | ✓ | ✓ | | `create` | ✓ | ✓ | | `edit` | ✓ | ✓ | | `delete` | ✓ | ✓ | | `details` | ✓ | ✓ | | `export` | ✓ | ✓ | | `ajax_lookup` (before fix) | ✗ | ✗ | | `ajax_lookup` (after fix) | ✓ | ✓ |</p> <p>Note: before this fix, `ajax_lookup` also lacked the `@login_required` decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.</p> <p>### Patches</p> <p>Two changes were made to `ajax_lookup`:</p> <p>1. Replaced the hand-rolled authentication check added in #1035 with the standard `@login_required` decorator used by all other endpoints. 2. Added the missing `is_accessible(request)` check, raising `HTTP 403` when it returns `False`.</p> <p>### Workarounds</p> <p>None. Developers relying on `is_accessible()` to restrict model visibility are exposed regardless of what other access controls are in place.</p> <p><strong>Affected:</strong> PyPI: sqladmin</p> <p>### Impact</p> <p>The `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all other endpoints enforce.</p> <p>If a developer restricts model access by overriding `is_accessible()`, an authenticated user can still query that model&#39;s data through the `ajax_lookup` endpoint — silently bypassing the restriction.</p> <p>**Affected endpoint:**</p> <p>`GET /{identity}/ajax/lookup?name=&lt;field&gt;&amp;term=&lt;query&gt;`</p> <p>**All other endpoints enforce both checks:**</p> <p>| Endpoint | `@login_required` | `is_accessible()` | |---|---|---| | `list` | ✓ | ✓ | | `create` | ✓ | ✓ | | `edit` | ✓ | ✓ | | `delete` | ✓ | ✓ | | `details` | ✓ | ✓ | | `export` | ✓ | ✓ | | `ajax_lookup` (before fix) | ✗ | ✗ | | `ajax_lookup` (after fix) | ✓ | ✓ |</p> <p>Note: before this fix, `ajax_lookup` also lacked the `@login_required` decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.</p> <p>### Patches</p> <p>Two changes were made to `ajax_lookup`:</p> <p>1. Replaced the hand-rolled authentication check added in #1035 with the standard `@login_required` decorator used by all other endpoints. 2. Added the missing `is_accessible(request)` check, raising `HTTP 403` when it returns `False`.</p> <p>### Workarounds</p> <p>None. Developers relying on `is_accessible()` to restrict model visibility are exposed regardless of what other access controls are in place.</p> https://cve.radiocsirt.org/vuln/ghsa-54mc-gghv-4cfj