CVE-2026-46645 Details
Description
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.
An authorization bypass vulnerability has been identified in SQLAdmin versions prior to 0.25.1. The issue arises in the ajax_lookup endpoint, which fails to enforce the is_accessible() access control check that is applied to all other endpoints. This allows authenticated users to query data from models that have restricted access, as defined by developers who override the is_accessible() method. The vulnerability exists because the ajax_lookup endpoint does not require login or access permissions, creating a silent bypass of access controls.
Users can upgrade to SQLAdmin version 0.25.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98 | [email protected] | Source CodeVendor |
| https://github.com/smithyhq/sqladmin/pull/1035 | [email protected] | Issue TrackingVendor |
| https://github.com/smithyhq/sqladmin/releases/tag/0.25.1 | [email protected] | Release NotesVendor |
| https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| smithyhq sqladmin | <= 0.25.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |