piccolo-orm vulnerabilities and threats

CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.