Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction. This issue has been patched in version 0.25.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-46645 Authentication Bypass in SQLAdmin Ajax Lookup Endpoint Prior to 0.25.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46645
Post summary
The entry lists CVE‑2026‑46645, describing an authentication bypass in SQLAdmin’s Ajax lookup endpoint prior to version 0.25.1, and provides a link to a CVE details page.