Executive Summary

The vulnerability exists in SQLAdmin versions prior to 0.25.1, specifically in the ajax_lookup endpoint within application.py. This endpoint bypasses the is_accessible() access control check that other endpoints enforce. As a result, if a developer restricts access to certain models by overriding is_accessible(), an authenticated user can still query data from those models through the ajax_lookup endpoint without restriction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users to silently bypass access control restrictions on certain data models. Consequently, users may gain unauthorized read access to sensitive data that should have been restricted, potentially leading to data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SQLAdmin to version 0.25.1 or later, where the ajax_lookup endpoint properly enforces the is_accessible() access control check.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users to bypass access control restrictions and query data models that should be restricted. Such unauthorized data access could lead to exposure of sensitive personal or protected health information.

As a result, organizations using affected versions of SQLAdmin may face challenges in maintaining compliance with data protection regulations like GDPR and HIPAA, which require strict access controls to protect personal and health information.

Useful 0 Not Useful 0