CVE-2026-46645 Overview
CVE-2026-46645 is a missing authorization vulnerability [CWE-862] in SQLAdmin, a flexible admin interface for SQLAlchemy models. Versions prior to 0.25.1 expose an ajax_lookup endpoint in application.py that does not invoke the is_accessible() access control check enforced by other endpoints. Authenticated users can query restricted model data through this endpoint even when developers explicitly override is_accessible() to limit visibility. The maintainers patched the issue in version 0.25.1.
Critical Impact
Authenticated users can bypass developer-defined model access restrictions and retrieve data from models they should not be able to read through the ajax_lookup endpoint.
Affected Products
- SQLAdmin versions prior to 0.25.1
- Applications using SQLAdmin with is_accessible() overrides for model-level access control
- Web applications exposing SQLAdmin to authenticated users with mixed privilege levels
Discovery Timeline
- 2026-06-10 - CVE-2026-46645 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-46645
Vulnerability Analysis
SQLAdmin provides an is_accessible() hook that developers override to restrict which authenticated users can view or modify a given model. The framework consistently invokes this hook across its standard CRUD endpoints. The ajax_lookup endpoint in application.py omits this check, creating an inconsistent enforcement boundary across the admin interface.
An authenticated user who lacks permission to view a model through the standard list or detail views can still issue requests to the ajax_lookup endpoint and receive matching records. The endpoint typically serves autocomplete and foreign-key selection widgets, returning model field data in JSON form. This silent bypass undermines least-privilege controls that developers assumed were globally enforced.
Root Cause
The root cause is a missing authorization check [CWE-862] in a single request handler. The ajax_lookup view did not call is_accessible() before resolving and returning model data. Because the other endpoints did enforce the check, developers had no signal that the access control surface was incomplete.
Attack Vector
Exploitation requires an authenticated session with the SQLAdmin application. The attacker crafts an HTTP request to the ajax_lookup endpoint, supplying the target model identifier and a search term. The endpoint returns matching rows without consulting is_accessible(), regardless of any developer-defined restriction. No special privileges, payloads, or user interaction are required beyond a valid login. See the GitHub Security Advisory GHSA-54mc-gghv-4cfj and the GitHub Commit Details for the precise code paths.
Detection Methods for CVE-2026-46645
Indicators of Compromise
- HTTP requests to URLs containing /ajax/lookup from authenticated users who lack standard list or detail access to the same model
- Successful HTTP 200 responses from ajax_lookup for models that should be restricted by is_accessible()
- Unexpected JSON payloads returned to non-privileged accounts containing fields from restricted SQLAlchemy models
Detection Strategies
- Review SQLAdmin and reverse-proxy access logs for ajax_lookup calls correlated with user identities and model names, then compare against expected role-to-model mappings.
- Instrument the application to log each ajax_lookup invocation alongside the result of a synthetic is_accessible() check for the requesting user, flagging mismatches.
- Hunt for enumeration patterns where a single authenticated session issues high volumes of ajax_lookup requests against multiple models.
Monitoring Recommendations
- Forward web application logs to a centralized SIEM and alert on ajax_lookup requests originating from accounts that have never accessed the corresponding model through standard views.
- Monitor outbound data volumes per session for SQLAdmin to detect bulk extraction from autocomplete endpoints.
- Track installed SQLAdmin versions across environments and alert when a deployment runs a version older than 0.25.1.
How to Mitigate CVE-2026-46645
Immediate Actions Required
- Upgrade SQLAdmin to version 0.25.1 or later in all environments that expose the admin interface to authenticated users.
- Audit application logs for prior ajax_lookup requests by users who should have been blocked by is_accessible() and assess data exposure.
- Rotate credentials and reset sessions for any accounts confirmed to have retrieved restricted data through the endpoint.
Patch Information
The fix is included in SQLAdmin 0.25.1, which adds the is_accessible() check to the ajax_lookup handler. Refer to the GitHub Release Notes 0.25.1, the GitHub Pull Request Review, and the GitHub Commit Details for the patch contents.
Workarounds
- If immediate upgrade is not possible, subclass the affected ModelView and override the ajax_lookup handler to invoke is_accessible() before returning results.
- Restrict access to the SQLAdmin mount point at the reverse-proxy layer so that only fully privileged administrators can reach any admin endpoint until the patch is applied.
- Temporarily disable AJAX-based foreign key lookups for restricted models by removing them from form_ajax_refs configurations.
# Upgrade SQLAdmin to the patched release
pip install --upgrade "sqladmin>=0.25.1"
# Verify the installed version
python -c "import sqladmin; print(sqladmin.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
