CVE-2026-46645

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.

• CWE-862

• https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98
• https://github.com/smithyhq/sqladmin/pull/1035
• https://github.com/smithyhq/sqladmin/releases/tag/0.25.1
• https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46639Twig is a template language for PHP. From 3.24.0 until 3.26.…6.5
• CVE-2026-4664The Customer Reviews for WooCommerce plugin for WordPress is…5.3
• CVE-2026-46640Twig is a template language for PHP. From 3.15.0 until 3.26.…8.8
• CVE-2026-46642draw.io is a configurable diagramming and whiteboarding appl…6.1
• CVE-2026-46643Snappy is a PHP library allowing thumbnail, snapshot or PDF …7.5
• CVE-2026-46644Symfony Polyfill backports PHP features and provides compati…6.9
• CVE-2026-4665The WP Carousel Free plugin for WordPress is vulnerable to S…6.4
• CVE-2026-46654Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to v…8.9
• CVE-2026-46656Bludit is a content management system. Versions prior to 3.2…8.8
• CVE-2026-46657Bludit is a content management system. Versions prior to 3.2…7.1
• CVE-2026-4666The wpForo Forum plugin for WordPress is vulnerable to unaut…6.5
• CVE-2026-46668SpiceDB is an open source database system for creating and m…2.3