Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55485— Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Quick assessment

Affected
piccolo-orm piccolo_admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Piccolo是Piccolo团队开源的一个快速、用户友好的 ORM 和查询构建器。 Piccolo 1.14.0之前版本存在安全漏洞，该漏洞源于会话令牌未标记为secret且非超级用户可通过GET请求获取其他用户的实时会话令牌并重放，导致攻击者冒充超级用户并提升权限，永久将自身用户的superuser设置为true。

CVSS 8.8 · High EPSS 0.56% · P46

Affected Version Matrix 1

VendorProduct Version RangeStatus
piccolo-orm piccolo_admin < 1.14.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55485

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Source: CVE Program / CVE List V5
Vulnerability Description
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Piccolo 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Piccolo是Piccolo团队开源的一个快速、用户友好的 ORM 和查询构建器。 Piccolo 1.14.0之前版本存在安全漏洞，该漏洞源于会话令牌未标记为secret且非超级用户可通过GET请求获取其他用户的实时会话令牌并重放，导致攻击者冒充超级用户并提升权限，永久将自身用户的superuser设置为true。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
piccolo-orm piccolo_admin < 1.14.0 -

II. Public POCs for CVE-2026-55485

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55485

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55485 (3)

Vendor Advisories for CVE-2026-55485 (1)

Vendor Pages for CVE-2026-55485 (2)

IV. Related Vulnerabilities

Same product: piccolo_admin
Same vendor: piccolo-orm
Same weakness: CWE-200

V. Comments for CVE-2026-55485

No comments yet

Leave a comment