CVE-2026-46645Medium· 4.3▾ TwilightPoC availableSQLAdmin: Authorization Bypass on `ajax_lookup`
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
1 GitHub repo
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=<field>&term=<query>
All other endpoints enforce both checks:
| Endpoint | @login_required | is_accessible() |
|---|---|---|
list | ✓ | ✓ |
create | ✓ | ✓ |
edit | ✓ | ✓ |
delete | ✓ | ✓ |
details | ✓ | ✓ |
export | ✓ | ✓ |
ajax_lookup (before fix) | ✗ | ✗ |
ajax_lookup (after fix) | ✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Two changes were made to ajax_lookup:
@login_required decorator used by all other endpoints.is_accessible(request) check, raising HTTP 403 when it returns False.None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
sqladmin < 0.25.1Upgrade to a patched release:
sqladmin 0.25.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.