CVE-2026-55485: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in piccolo-orm piccolo_admin
Description
CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.
CVSS v3.1
Score 8.8high
Affected software
piccolo-orm
piccolo_admin
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Piccolo Admin versions before 1.14.0 permit non-superuser administrators to perform GET requests on configured user and session tables without proper authorization checks. The SessionsBase.token field is exposed and not treated as secret, enabling an attacker to retrieve another user's live session token. By replaying this token as a cookie, the attacker can impersonate a superuser and escalate their privileges permanently by setting their own superuser flag to true. This vulnerability is addressed in piccolo_admin version 1.14.0.
Potential Impact
An attacker with non-superuser administrator access can obtain live session tokens of other users, including superusers, and use these tokens to impersonate them. This leads to unauthorized privilege escalation, allowing the attacker to gain superuser rights permanently. The vulnerability compromises confidentiality, integrity, and availability of the system as indicated by the CVSS vector.
Mitigation Recommendations
This vulnerability is fixed in piccolo_admin version 1.14.0. Users should upgrade to version 1.14.0 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in the vendor advisory, but the fix version is stated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:28:27.061Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a91e40eacd9273b4942e83d
Added to database: 08/28/2026, 19:39:58 UTC
Last enriched: 09/07/2026, 15:23:08 UTC
Last updated: 10/10/2026, 18:48:20 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.