PyPI/piccolo-admin CVE-2026-55485: high 8.8, EPSS 0.56%

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Action: Upgrade piccolo-admin to 1.14.0 or later.

pip install piccolo-admin==1.14.0

Affected

Fixed versions

Sources

• osv: GHSA-2gh4-jmwq-rr8w
• https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w
• https://github.com/piccolo-orm/piccolo_api/pull/331
• https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
• https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4
• https://github.com/piccolo-orm/piccolo_admin
• https://github.com/piccolo-orm/piccolo_admin/releases/tag/1.14.0
• https://github.com/piccolo-orm/piccolo_api/releases/tag/1.10.0

CVE-2026-55485 · published 2026-08-28T18:14:13Z · modified 2026-09-10T12:25:39.426417744Z · JSON