CVE-2026-55485

Non‑superuser can grab session token via GET and impersonate superuser privileges.

• CVSS 8.8
• 200
• Authentication, Authorization, and Session Management
• Remote

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.

CVE

CVE-2026-55485

CWE

200

CVSS base score

8.8

Published

2026-08-28

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Session Management Issues

Accessibility scope

Remote

Impact

Privilege Escalation

Affected component

piccolo_admin

Fixed by upgrading

Yes

Solution

Upgrade Piccolo Admin to version 1.14.0 or later.

from piccolo_api.session_auth.tables import SessionsBase
from piccolo_admin.endpoints import superuser_validators

def get_table_rows(table_cls, request):
    # VULNERABLE: exposes Sessions.token to non‑superusers via GET
    if request.method == "GET":
        # superuser_validators only blocks mutating methods
        superuser_validators(request)
        rows = table_cls.select().run()
        return rows
    else:
        # block non‑superusers for mutating methods
        superuser_validators(request, require_superuser=True)
        # ... handle POST/PATCH/DELETE ...
        pass

from piccolo_api.session_auth.tables import SessionsBase
from piccolo_admin.endpoints import superuser_validators

def get_table_rows(table_cls, request):
    # FIX: hide Sessions.token from non‑superusers on GET
    if request.method == "GET":
        superuser_validators(request)
        if table_cls is SessionsBase:
            # Exclude the token column for non‑superusers
            rows = table_cls.select().exclude("token").run()
        else:
            rows = table_cls.select().run()
        return rows
    else:
        superuser_validators(request, require_superuser=True)
        # ... handle POST/PATCH/DELETE ...
        pass

@misc{vaitp:cve202655485,
  title        = {{Non‑superuser can grab session token via GET and impersonate superuser privileges.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-55485},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-55485/}}
}