SQL Injection Bypass in SQLAlchemy Admin Interface

CVE-2026-46645

What is CVE-2026-46645?

The SQLAdmin interface for SQLAlchemy models contains a significant vulnerability allowing unauthorized data access. Specifically, the ajax_lookup endpoint does not enforce the is_accessible() access control check seen in other endpoints. This means that if a developer has set model access restrictions, an authenticated user can still retrieve sensitive model information through this endpoint, effectively circumventing intended access controls. This vulnerability has been addressed in version 0.25.1, emphasizing the importance of keeping software updated to mitigate security risks.

References