{"id":"CVE-2026-46645","aliases":["GHSA-54mc-gghv-4cfj","PYSEC-2026-3073"],"title":"SQLAdmin: Authorization Bypass on `ajax_lookup`","summary":"SQLAdmin: Authorization Bypass on `ajax_lookup`","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","vendor":"sqladmin","product":"sqladmin","ecosystem":"pip","affected":["sqladmin < 0.25.1"],"patched":["sqladmin 0.25.1"],"published":"2026-05-21","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-54mc-gghv-4cfj","references":[{"url":"https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46645"},{"url":"https://github.com/smithyhq/sqladmin/pull/1035"},{"url":"https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"},{"url":"https://github.com/smithyhq/sqladmin"},{"url":"https://github.com/smithyhq/sqladmin/releases/tag/0.25.1"}],"tags":["osv","pip","exploit-available"],"epss":0.00279,"epssPercentile":0.20638,"ingestedAt":"2026-07-13T18:57:52.999Z","exploits":{"github":1,"githubRepos":["https://github.com/rootdirective-sec/CVE-2026-46645-Analysis-Lab"],"checkedAt":"2026-09-23T07:14:07.266Z"},"exploitAvailable":true,"slug":"CVE-2026-46645","body":"## Overview\n\n### Impact\n\nThe `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all other endpoints enforce.\n\nIf a developer restricts model access by overriding `is_accessible()`, an authenticated user can still query that model's data through the `ajax_lookup` endpoint — silently bypassing the restriction.\n\n**Affected endpoint:**\n\n`GET /{identity}/ajax/lookup?name=<field>&term=<query>`\n\n**All other endpoints enforce both checks:**\n\n| Endpoint | `@login_required` | `is_accessible()` |\n|---|---|---|\n| `list` | ✓ | ✓ |\n| `create` | ✓ | ✓ |\n| `edit` | ✓ | ✓ |\n| `delete` | ✓ | ✓ |\n| `details` | ✓ | ✓ |\n| `export` | ✓ | ✓ |\n| `ajax_lookup` (before fix) | ✗ | ✗ |\n| `ajax_lookup` (after fix) | ✓ | ✓ |\n\nNote: before this fix, `ajax_lookup` also lacked the `@login_required` decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.\n\n### Patches\n\nTwo changes were made to `ajax_lookup`:\n\n1. Replaced the hand-rolled authentication check added in #1035 with the standard `@login_required` decorator used by all other endpoints.\n2. Added the missing `is_accessible(request)` check, raising `HTTP 403` when it returns `False`.\n\n### Workarounds\n\nNone. Developers relying on `is_accessible()` to restrict model visibility are exposed regardless of what other access controls are in place.\n\n## Affected packages\n\n- `sqladmin < 0.25.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sqladmin 0.25.1`","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5258,"id":"CVE-2026-46645","ts":1788887257119,"field":"exploit_available","old":"false","new":"true"},{"seq":4141,"id":"CVE-2026-46645","ts":1788886373544,"field":"exploit_available","old":"true","new":"false"},{"seq":2910,"id":"CVE-2026-46645","ts":1788883039425,"field":"exploit_available","old":"false","new":"true"},{"seq":1939,"id":"CVE-2026-46645","ts":1788882442457,"field":"exploit_available","old":"true","new":"false"},{"seq":1027,"id":"CVE-2026-46645","ts":1788881877413,"field":"exploit_available","old":"false","new":"true"}]}