CVE-2026-55485

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.14.0

Description Piccolo Admin contains an authorization bypass and sensitive information leak. The superuser validators() function in piccolo admin/endpoints.py uses a deny-list that blocks PUT, PATCH, DELETE, and POST requests for non-superusers but fails to block GET requests. Simultaneously, the SessionsBase.token variable in piccolo api/session auth/tables.py is not marked as secret, causing session tokens to be exposed in plaintext in GET responses.

In configurations where the Sessions and User tables are added to create admin, a non-superuser administrator can use the GET /api/tables/sessions/ endpoint to obtain live session tokens of other users. By replaying a superuser's token as the id cookie value, an attacker can impersonate a superuser and permanently elevate their own privileges by setting the superuser variable to true on their own account row.

Recommendations Update Piccolo Admin to version 1.14.0. As a temporary mitigation, restrict access to the Sessions and User tables within the create admin configuration to prevent non-superusers from accessing these resources.