CVE-2026-46645

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
smithyhq	sqladmin	< 0.25.1

References

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-466499.1Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GE CVE-2026-46656.4The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all CVE-2026-466504.4Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in CVE-2026-466519.8The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version CVE-2026-466529.8The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version CVE-2026-466548.9Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can cr CVE-2026-466557.8virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege loc CVE-2026-466568.8Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even af CVE-2026-466577.1Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated ac CVE-2026-46666.5The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of `extract($args, EXTR_OVERWRITE)` CVE-2026-466682.3SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before CVE-2026-466697.5OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing gues