CVE-2026-55485: Piccolo Admin Auth Bypass Vulnerability

CVE-2026-55485 Overview

CVE-2026-55485 affects Piccolo Admin, an admin interface and content management system for Python built on the Piccolo ORM. The vulnerability allows a non-superuser administrator to retrieve another user's live session token through the exposed sessions API endpoint. An attacker replays the stolen token as the id cookie to impersonate a superuser. The attacker can then permanently escalate their own account by setting superuser to true. The flaw stems from SessionsBase.token not being marked as a secret column, combined with superuser_validators in piccolo_admin/endpoints.py blocking write methods but permitting GET requests on user and session tables ([CWE-200]).

Critical Impact
Authenticated low-privilege administrators can hijack superuser sessions and grant themselves permanent superuser rights, resulting in full compromise of the admin interface.

Affected Products

Piccolo Admin versions prior to 1.14.0
Piccolo API versions prior to 1.10.0 (containing SessionsBase)
Deployments registering Sessions and User tables with create_admin

Discovery Timeline

2026-08-28 - CVE-2026-55485 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55485

Vulnerability Analysis

The vulnerability chains two design weaknesses in the Piccolo ecosystem. First, piccolo_admin/endpoints.py applies superuser_validators to reject PUT, PATCH, DELETE, and POST requests from non-superusers against configured user and session tables, but leaves GET requests unrestricted. Second, piccolo_api/session_auth/tables.py defines SessionsBase.token as a regular Varchar column rather than a secret column. As a result, the auto-generated CRUD serializer for the sessions table includes the raw token in read responses. Any authenticated administrator can query GET /api/tables/sessions/ and receive live session tokens for every active user, including superusers.

Root Cause

The root cause is improper information exposure through the CRUD read endpoint. The token column lacked the secret=True parameter, so it was not excluded from auto-generated Pydantic response models. Access control on the sessions table only covered mutating verbs, not read operations, violating the principle that authentication tokens must never be returned in API responses.

Attack Vector

An attacker authenticated as a non-superuser admin calls GET /api/tables/sessions/ and enumerates active session tokens. The attacker sets the retrieved token as the id cookie on subsequent requests, impersonating the superuser whose session was stolen. Using the elevated context, the attacker issues a PATCH against their own user row and sets superuser = true, achieving persistent privilege escalation even after the hijacked session expires.

python

# Patch: Mark the token column as secret so CRUD read endpoints exclude it
# Source: https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4

email_columns = self.table._meta.email_columns
secret_columns = self.table._meta.secret_columns

base_model = create_pydantic_model(
    self.table,
    include_default_columns=True,
    exclude_columns=(
        *multidimensional_array_columns,
        *email_columns,
        *secret_columns,
    ),
    all_optional=True,
    model_name=model_name,
)

Source: Piccolo API commit 520ec25

Detection Methods for CVE-2026-55485

Indicators of Compromise

Unexpected GET requests to /api/tables/sessions/ or /api/tables/sessions/<id>/ from non-superuser accounts.
Session id cookie values that do not match the authenticated user's issued token.
PATCH requests against /api/tables/user/ where the request body sets superuser to true.
New superuser accounts created outside of documented administrative workflows.

Detection Strategies

Inspect HTTP access logs for reads against the sessions endpoint by any principal other than a designated superuser.
Correlate authentication cookies with the account identity that issued them; mismatches indicate token replay.
Audit the piccolo_user.superuser column for changes and alert on transitions from false to true.

Monitoring Recommendations

Enable structured request logging on the Piccolo Admin ASGI app and forward logs to a central SIEM.
Track failed authorization events emitted by superuser_validators to identify reconnaissance against restricted endpoints.
Monitor changes to the sessions and piccolo_user tables through database audit logging.

How to Mitigate CVE-2026-55485

Immediate Actions Required

Upgrade Piccolo Admin to 1.14.0 or later and Piccolo API to 1.10.0 or later.
Invalidate all existing sessions by truncating the sessions table after upgrading.
Review the piccolo_user table for unauthorized superuser = true entries and revoke them.
Rotate credentials for any accounts that held superuser privileges during the exposure window.

Patch Information

The fix is delivered in Piccolo Admin 1.14.0, which bumps the piccolo_api requirement to >=1.10.0. Piccolo API 1.10.0 marks SessionsBase.token as a secret column and updates the CRUD endpoint to exclude secret columns from response models. See the GitHub Security Advisory GHSA-2gh4-jmwq-rr8w for advisory details and Pull Request 331 for the code changes.

Workarounds

Remove the Sessions and User tables from the create_admintables argument until upgrading.
Restrict admin access to superuser accounts only, eliminating the low-privilege administrator role that enables the attack.
Place the admin interface behind network access controls that limit exposure to trusted operators.

bash

# Upgrade to patched versions
pip install --upgrade 'piccolo_admin>=1.14.0' 'piccolo_api>=1.10.0'

# Apply the session_auth migration that marks token as secret
piccolo migrations forwards session_auth