Vulnerability-Lookup

CVE-2026-54529 (GCVE-0-2026-54529)

Vulnerability from cvelistv5 – Published: 2026-09-14 15:38 – Updated: 2026-09-14 16:29

Title

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application's available fields and data. This issue is fixed in version 0.27.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:29 UTC

CWE

CWE-20 - Improper Input Validation
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-248 - Uncaught Exception
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/smithyhq/sqladmin/security/adv…	x_refsource_CONFIRM
https://github.com/smithyhq/sqladmin/commit/74163…	x_refsource_MISC
https://github.com/smithyhq/sqladmin/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
smithyhq	sqladmin	Affected: < 0.27.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54529",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:29:34.201376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:29:44.765Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sqladmin",
          "vendor": "smithyhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application\u0027s available fields and data. This issue is fixed in version 0.27.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T15:38:14.083Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v"
        },
        {
          "name": "https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a"
        },
        {
          "name": "https://github.com/smithyhq/sqladmin/releases/tag/0.27.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.27.1"
        }
      ],
      "source": {
        "advisory": "GHSA-ccg5-9c8w-xh6v",
        "discovery": "UNKNOWN"
      },
      "title": "SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54529",
    "datePublished": "2026-09-14T15:38:14.083Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-09-14T16:29:44.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54529\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T16:17:12.050\",\"lastModified\":\"2026-09-14T17:17:47.487\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application\u0027s available fields and data. This issue is fixed in version 0.27.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"smithyhq\",\"product\":\"sqladmin\",\"versions\":[{\"version\":\"\u003c 0.27.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T16:29:34.201376Z\",\"id\":\"CVE-2026-54529\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-248\"},{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/smithyhq/sqladmin/releases/tag/0.27.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54529\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T16:29:34.201376Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T16:29:40.077Z\"}}], \"cna\": {\"title\": \"SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`\", \"source\": {\"advisory\": \"GHSA-ccg5-9c8w-xh6v\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"smithyhq\", \"product\": \"sqladmin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.27.1\"}]}], \"references\": [{\"url\": \"https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v\", \"name\": \"https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a\", \"name\": \"https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/smithyhq/sqladmin/releases/tag/0.27.1\", \"name\": \"https://github.com/smithyhq/sqladmin/releases/tag/0.27.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application\u0027s available fields and data. This issue is fixed in version 0.27.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T15:38:14.083Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54529\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-14T16:29:44.765Z\", \"dateReserved\": \"2026-06-15T18:40:01.651Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-14T15:38:14.083Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54529

Vulnerability from fkie_nvd - Published: 2026-09-14 16:17 - Updated: 2026-09-14 17:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a
	security-advisories@github.com	https://github.com/smithyhq/sqladmin/releases/tag/0.27.1
	security-advisories@github.com	https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sqladmin",
          "vendor": "smithyhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application\u0027s available fields and data. This issue is fixed in version 0.27.1."
    }
  ],
  "id": "CVE-2026-54529",
  "lastModified": "2026-09-14T17:17:47.487",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54529",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T16:29:34.201376Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T16:17:12.050",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/smithyhq/sqladmin/commit/741635f18f93c020bfe355167ab257da9a6ca99a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.27.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CCG5-9C8W-XH6V

Vulnerability from github – Published: 2026-09-09 18:01 – Updated: 2026-09-09 18:01

Summary

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Details

Summary

ModelView.sort_query() uses the attacker-controlled sortBy list-view query parameter without checking it against the configured column_sortable_list allow-list. The value is resolved with getattr(model, ...) and fed into relationship joins and order_by(), so a request can sort by any column of the model — including ones hidden from column_list — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure ordering oracle.

Root cause

column_sortable_list is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.

Exploitation

A single request leaks the relative ordering of an unexposed column; the asc↔desc reversal confirms rows are ordered by the secret's actual value. Pairing sortBy with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sqladmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54529"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-200",
      "CWE-248",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T18:01:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`ModelView.sort_query()` uses the attacker-controlled `sortBy` list-view query parameter without checking it against the configured `column_sortable_list` allow-list. The value is resolved with `getattr(model, ...)` and fed into relationship joins and `order_by()`, so a request can sort by **any** column of the model \u2014 including ones hidden from `column_list` \u2014 and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure **ordering oracle**.\n\n## Root cause\n\n`column_sortable_list` is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.\n\n## Exploitation\n\nA single request leaks the relative ordering of an unexposed column; the `asc`\u2194`desc` reversal confirms rows are ordered by the secret\u0027s actual value. Pairing `sortBy` with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.",
  "id": "GHSA-ccg5-9c8w-xh6v",
  "modified": "2026-09-09T18:01:56Z",
  "published": "2026-09-09T18:01:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/smithyhq/sqladmin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.27.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`"
}

PYSEC-2026-3922

Vulnerability from pysec - Published: 2026-09-10 09:45 - Updated: 2026-09-10 11:02

Details

Summary

Root cause

column_sortable_list is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.

Exploitation

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impacted products

Name	purl
sqladmin	pkg:pypi/sqladmin

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sqladmin",
        "purl": "pkg:pypi/sqladmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.0",
        "0.1.0",
        "0.1.1",
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.10.3",
        "0.11.0",
        "0.12.0",
        "0.13.0",
        "0.14.0",
        "0.14.1",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.16.0",
        "0.16.1",
        "0.17.0",
        "0.18.0",
        "0.19.0",
        "0.2.0",
        "0.2.1",
        "0.20.0",
        "0.20.1",
        "0.21.0",
        "0.22.0",
        "0.23.0",
        "0.24.0",
        "0.25.0",
        "0.25.1",
        "0.26.0",
        "0.27.0",
        "0.3.0",
        "0.4.0",
        "0.5.0",
        "0.6.0",
        "0.6.1",
        "0.7.0",
        "0.8.0",
        "0.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54529",
    "GHSA-ccg5-9c8w-xh6v"
  ],
  "details": "## Summary\n\n`ModelView.sort_query()` uses the attacker-controlled `sortBy` list-view query parameter without checking it against the configured `column_sortable_list` allow-list. The value is resolved with `getattr(model, ...)` and fed into relationship joins and `order_by()`, so a request can sort by **any** column of the model \u2014 including ones hidden from `column_list` \u2014 and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure **ordering oracle**.\n\n## Root cause\n\n`column_sortable_list` is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.\n\n## Exploitation\n\nA single request leaks the relative ordering of an unexposed column; the `asc`\u2194`desc` reversal confirms rows are ordered by the secret\u0027s actual value. Pairing `sortBy` with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.",
  "id": "PYSEC-2026-3922",
  "modified": "2026-09-10T11:02:32.776818Z",
  "published": "2026-09-10T09:45:01.332936Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/smithyhq/sqladmin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smithyhq/sqladmin/releases/tag/0.27.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/sqladmin"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-ccg5-9c8w-xh6v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54529"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54529 (GCVE-0-2026-54529)

FKIE_CVE-2026-54529

GHSA-CCG5-9C8W-XH6V

Summary

Root cause

Exploitation

PYSEC-2026-3922

Summary

Root cause

Exploitation

Tags

Sightings

Nomenclature