SQLAdmin: Authorization Bypass on `ajax_lookup`
Description
Impact
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=&term=
All other endpoints enforce both checks:
| Endpoint | @login_required | is_accessible() | |---|---|---| | list | ✓ | ✓ | | create | ✓ | ✓ | | edit | ✓ | ✓ | | delete | ✓ | ✓ | | details | ✓ | ✓ | | export | ✓ | ✓ | | ajax_lookup (before fix) | ✗ | ✗ | | ajax_lookup (after fix) | ✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Patches
Two changes were made to ajax_lookup:
- Replaced the hand-rolled authentication check added in #1035 with the standard
@login_requireddecorator used by all other endpoints. - Added the missing
is_accessible(request)check, raisingHTTP 403when it returnsFalse.
Workarounds
None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
The ajax_lookup endpoint in sqladmin bypasses the is_accessible() access control, allowing authenticated but unauthorized users to query restricted model data.
Vulnerability
The ajax_lookup endpoint in sqladmin's application.py lacked both the @login_required decorator and the is_accessible() check that all other administrative endpoints enforce. This allowed unauthenticated and authenticated but unauthorized users to query any model's data via GET /{identity}/ajax/lookup?name=&term= [1][2].
Exploitation
An attacker with any authenticated session could craft a request to the ajax_lookup endpoint with a term parameter to retrieve data from models that the developer had restricted by overriding is_accessible(). No special privileges beyond authentication were required [1]. Prior to this fix, the endpoint also lacked authentication entirely, but that was partially addressed in pull request #1035 [3].
Impact
Developers relying on is_accessible() to restrict model visibility are exposed. An authenticated user can silently bypass the intended access control and query sensitive model data, potentially leading to unauthorized information disclosure [1][2].
Mitigation
The fix applies the standard @login_required decorator and adds an explicit is_accessible(request) check, returning HTTP 403 when access is denied [1]. No workarounds exist; developers must update to the patched version to close the gap [2].
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.