CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.

• CWE-200
• CWE-269
• CWE-863

• https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
• https://github.com/piccolo-orm/piccolo_admin/releases/tag/1.14.0
• https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w
• https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4
• https://github.com/piccolo-orm/piccolo_api/pull/331
• https://github.com/piccolo-orm/piccolo_api/releases/tag/1.10.0
• https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55479Snipe-IT is an IT asset/license management system. Prior to …4.3
• CVE-2026-5548A vulnerability was found in Tenda AC10 16.03.10.10_multi_TD…8.8
• CVE-2026-55481Snipe-IT is an IT asset/license management system. Prior to …4.8
• CVE-2026-55482Snipe-IT is an IT asset/license management system. Prior to …6.3
• CVE-2026-55483Snipe-IT is an IT asset/license management system. Prior to …4.9
• CVE-2026-55484ALOS HTTP is a Linux-first Go web framework and application …7.5
• CVE-2026-55487pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the …8.8
• CVE-2026-55488motionEye (mEye) is an online interface for a piece of softw…7.7
• CVE-2026-55489BigBlueButton is an open-source virtual classroom. Prior to …4.9
• CVE-2026-5549A vulnerability was determined in Tenda AC10 16.03.10.10_mul…7.5
• CVE-2026-55490OpenWrt is a Linux operating system targeting embedded devic…6.5
• CVE-2026-55491BigBlueButton is an open-source virtual classroom. Prior to …5.4