{"id":"CVE-2026-54529","aliases":["PYSEC-2026-3922"],"url":"https://o3.security/vulnerability/CVE-2026-54529","summary":"SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`","details":"## Summary\n\n`ModelView.sort_query()` uses the attacker-controlled `sortBy` list-view query parameter without checking it against the configured `column_sortable_list` allow-list. The value is resolved with `getattr(model, ...)` and fed into relationship joins and `order_by()`, so a request can sort by **any** column of the model — including ones hidden from `column_list` — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure **ordering oracle**.\n\n## Root cause\n\n`column_sortable_list` is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.\n\n## Exploitation\n\nA single request leaks the relative ordering of an unexposed column; the `asc`↔`desc` reversal confirms rows are ordered by the secret's actual value. Pairing `sortBy` with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.","published":"2026-09-09T18:01:56Z","modified":"2026-09-10T12:25:57.816349510Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"sqladmin","fixedVersion":"0.27.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v"},{"type":"PACKAGE","url":"https://github.com/smithyhq/sqladmin"},{"type":"WEB","url":"https://github.com/smithyhq/sqladmin/releases/tag/0.27.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T12:25:57.816349510Z"}}