CVE-2026-55485

Received Received - Intake

Session Token Exposure in Piccolo Admin Leading to Privilege Escalation

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55485

EUVD

EUVD-2026-67858

Affected Vendors & Products

Vendor	Product	Version / Range
piccolo	piccolo_admin	1.14.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-55485 is a privilege escalation flaw in Piccolo Admin versions before 1.14.0. Non-superuser admins can exploit it by making GET requests to retrieve session tokens, including superusers', then replaying a stolen token to modify their own user record and permanently grant themselves superuser privileges.

Detection Guidance

Check Piccolo Admin versions below 1.14.0. Inspect GET requests to /api/tables/sessions/ for exposed session tokens. Look for unauthorized PATCH requests modifying user records to set superuser=true. Review logs for plaintext token exposure in responses.

Impact Analysis

An attacker could gain full administrative control over the system, allowing data theft, modification, deletion, session revocation, and potential payload execution. This requires only non-superuser admin access and network connectivity.

Mitigation Strategies

Upgrade Piccolo Admin to version 1.14.0 or later. Ensure piccolo_api is updated to version 1.10.0 or higher to mark session tokens as secret. Restrict access to admin endpoints and monitor for suspicious GET/PATCH requests to session or user tables.

Hi! I’m here to help you understand CVE-2026-55485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70