CVE-2026-55485

Piccolo Admin, a Python admin interface and CMS built on the Piccolo ORM, fails to keep session tokens secret in versions prior to 1.14.0 because the SessionsBase.token column is not marked secret and the admin API allows GET requests to configured user and session tables. In deployments that register the Sessions and User tables with create_admin, a non-superuser administrator can call GET /api/tables/sessions/, read another user's live session token, and replay it as the Cookie id value to impersonate a superuser. While impersonating a superuser, the attacker can permanently set the superuser flag to true on their own account row, gaining persistent privileged access to the admin interface and the data tables it manages. Only deployments that added the Sessions and User tables to create_admin are affected, and the attacker must already hold a valid low-privilege account on the system. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to Piccolo Admin 1.14.0 or later. As an interim mitigation, remove the Sessions and User tables from create_admin (or otherwise restrict GET access to those tables) for non-superusers. Administrators should also audit accounts for unexpected superuser=true flags and expire or rotate active session tokens if compromise is suspected, since an attacker's escalation persists.