Executive brief
piccolo-admin is a web-based database administration interface. A non-superuser admin can exploit flawed access controls to read live session tokens of other users (including superusers) via an unprotected GET endpoint, then replay those tokens to impersonate a superuser and permanently grant themselves full administrative privileges. This breaks the intended privilege boundary and allows complete takeover of the admin panel.
Technical details
The vulnerability combines two authorization flaws in piccolo-admin (≤1.13.0) and piccolo-api (≤1.9.0). First, the superuser_validators function in piccolo_admin/endpoints.py uses a method deny-list (rejecting PUT/PATCH/DELETE/POST) rather than an allow-list, leaving GET requests unprotected. Second, SessionsBase.token in piccolo_api/session_auth/tables.py is a Varchar field without secret=True, so it is included in all JSON responses by default. An attacker with valid non-superuser admin credentials (the default role from BaseUser.create_user(admin=True)) can issue GET /api/tables/sessions/ to retrieve all active session tokens in plaintext, copy a superuser's token, use it as a Cookie: id= value to impersonate that superuser, and then issue a PATCH request to write superuser=true to their own user record. The resulting privilege elevation is permanent; the attacker retains superuser access even after logging out. Patches were released in piccolo-admin 1.14.0 and piccolo_api 1.10.0.
Affected products
- piccolo-orm piccolo-admin <=1.13.0
- piccolo-orm piccolo-api <=1.9.0
Timeline
- 2026-06-19: disclosed: Vulnerability disclosed; advisory published to GitHub
- 2026-06-19: patched: Patches released: piccolo-admin 1.14.0 and piccolo-api 1.10.0
- 2026-08-28: advisory: Advisory published to GitHub Advisory Database
References
- https://api.github.com/users/black-shadow-007
- https://github.com/black-shadow-007
- https://api.github.com/users/black-shadow-007/gists%7B/gist_id%7D
- https://api.github.com/users/black-shadow-007/repos
- https://avatars.githubusercontent.com/u/205796698?v=4
- https://api.github.com/users/black-shadow-007/events%7B/privacy%7D