Executive brief
SQLAdmin is an administrative interface used by developers to manage database records through a web browser. A security flaw was identified where certain data lookup features did not properly check if a user had permission to view specific database models. This could allow an authenticated user to view sensitive information they are normally restricted from seeing, potentially leading to unauthorized data exposure.
Technical details
A missing authorization check (CWE-862) exists in the `ajax_lookup` endpoint of SQLAdmin prior to version 0.25.1. While other administrative endpoints enforce access control via the `is_accessible()` method, the `ajax_lookup` endpoint in `application.py` failed to implement this check. An authenticated attacker can exploit this by sending crafted GET requests to the `/{identity}/ajax/lookup` endpoint to query model data that should be restricted. Additionally, versions prior to the initial fix attempt also lacked the `@login_required` decorator, potentially allowing unauthenticated access. The vulnerability is resolved in version 0.25.1 by implementing both the `@login_required` decorator and the `is_accessible()` authorization check.
Affected products
- smithyhq sqladmin < 0.25.1
Timeline
- 2026-04-18: other: Initial pull request to address unauthenticated access submitted
- 2026-05-16: patched: Version 0.25.1 released with full authorization fixes
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD