SQL Injection Risk in SQLAdmin for SQLAlchemy Models by SmithyHQ
CVE-2026-54529

5.3MEDIUM

Key Information:

Vendor

Smithyhq

Status
Sqladmin
Vendor
CVE Published:
14 September 2026

What is CVE-2026-54529?

The SQLAdmin interface for SQLAlchemy models contained a vulnerability that allowed unauthorized access to sensitive information through improperly handled sort queries. Prior to version 0.27.1, the ModelView.sort_query method failed to validate the sortBy parameter against a server-side allow-list, enabling attackers to manipulate the sorting of hidden and related-model columns. This flaw created an information exposure risk, as the order of rows could disclose unexposed values when combined with filters and paginations. The issue has been resolved in version 0.27.1, making it crucial for users to update their installations.

Affected Version(s)

sqladmin < 0.27.1

References

https://github.com/smithyhq/sqladmin/security/advisories/...
x_refsource_CONFIRM
https://github.com/smithyhq/sqladmin/commit/741635f18f93c...
x_refsource_MISC
https://github.com/smithyhq/sqladmin/releases/tag/0.27.1
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.