CVE-2026-55485
2 advisories.
PyPI/piccolo-admin CVE-2026-55485: high 8.8
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Action: Upgrade piccolo-admin to 1.14.0 or later.
pip install piccolo-admin==1.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.14.0 | - |
Fixed versions
| 1.14.0 |
Sources
- osv: GHSA-2gh4-jmwq-rr8w
- https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w
- https://github.com/piccolo-orm/piccolo_api/pull/331
- https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
- https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4
- https://github.com/piccolo-orm/piccolo_admin
- https://github.com/piccolo-orm/piccolo_admin/releases/tag/1.14.0
- https://github.com/piccolo-orm/piccolo_api/releases/tag/1.10.0
CVE-2026-55485 · published · modified · JSON
PyPI/piccolo-admin CVE-2026-55485: high 8.8
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Action: Upgrade piccolo-admin to 1.14.0 or later.
pip install piccolo-admin==1.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.14.0 | - |
Fixed versions
| 1.14.0 |
Sources
- osv: PYSEC-2026-3882
- https://github.com/piccolo-orm/piccolo_admin/security/advisories/GHSA-2gh4-jmwq-rr8w
- https://github.com/piccolo-orm/piccolo_api/pull/331
- https://github.com/piccolo-orm/piccolo_admin/commit/96ddae12baf12288056cbb0cda6f9e8d7e22c86d
- https://github.com/piccolo-orm/piccolo_api/commit/520ec2567ae1d2cc417c8c0d1ad0ddc05549a8a4
- https://github.com/piccolo-orm/piccolo_admin
- https://github.com/piccolo-orm/piccolo_admin/releases/tag/1.14.0
- https://github.com/piccolo-orm/piccolo_api/releases/tag/1.10.0
- https://pypi.org/project/piccolo-admin
- https://github.com/advisories/GHSA-2gh4-jmwq-rr8w
- https://nvd.nist.gov/vuln/detail/CVE-2026-55485
CVE-2026-55485 · published · modified · JSON