CVE-2026-54529
Received Received - Intake

SQL Injection Oracle in SQLAdmin Admin Interface

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application's available fields and data. This issue is fixed in version 0.27.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54529
EUVD
EUVD-2026-77581

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sqladmin sqladmin 0.27.1
smithyhq sqladmin to 0.27.1 (exc)
smithyhq sqladmin 0.27.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SQLAdmin is a library for creating admin interfaces for SQLAlchemy models. This vulnerability exists in versions before 0.27.1. The issue is in the ModelView.sort_query method which accepts a sortBy parameter without proper validation. Attackers can use this to sort results by any column, including hidden ones or related-model columns, creating an information-exposure risk where data order can be inferred.

Detection Guidance

To detect this vulnerability, check if your SQLAdmin version is below 0.27.1. Run: pip show sqladmin. If installed, verify the version. Exploit attempts may include sending requests with custom sortBy parameters to observe if hidden columns or related-model columns are sortable. Monitor for HTTP 400 errors when invalid sortBy values are used.

Impact Analysis

An attacker could exploit this to infer the relative ordering of sensitive data that isn't normally visible. By combining this with search or filter functions, they might narrow down specific values. The impact is limited to information exposure rather than data modification or deletion.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's privacy rules. The information exposure risk may result in non-compliance with these regulations' data protection and confidentiality provisions.

Mitigation Strategies

Upgrade SQLAdmin to version 0.27.1 or later immediately. If upgrading is not possible, implement server-side validation for the sortBy parameter to enforce the column_sortable_list allow-list. Ensure no custom sortBy values bypass the configured allow-list.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54529. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart