Vulnerability in Piccolo Admin for Python Affects Session Management

CVE-2026-55485

What is CVE-2026-55485?

Piccolo Admin, an admin interface and content management system built on Piccolo, is susceptible to a vulnerability impacting session management. Versions prior to 1.14.0 allow non-superuser administrators to exploit a weakness in the endpoint permissions. Specifically, the implementation allows GET requests to user and session tables without adequate validation, which exposes sensitive information, including another user's live session token. This can lead to unauthorized impersonation of a superuser by replaying the obtained session token and modifying their own administrative privileges. The vulnerability is addressed in version 1.14.0, which restricts access permissions and enhances security measures.

References