CVE-2026-54529: Input Validation
Summary
ModelView.sortquery() uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattr(model, ...) and fed into relationship joins and orderby(), so a request can sort by any column of the model — including ones hidden from columnlist — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure ordering oracle.
Root cause
columnsortablelist is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.
Exploitation
A single request leaks the relative ordering of an unexposed column; the asc↔desc reversal confirms rows are ordered by the secret's actual value. Pairing sortBy with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/sqladminto a version that resolves this vulnerability.Fixed in 0.27.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote requester can exploit it where they can reach a SQLAdmin model list view. No privileges or user interaction are required.
Are columns hidden from the list view protected from sorting?
No. Removing a field from column_list or omitting it from column_sortable_list only affects rendered header links; the server accepts attacker-supplied sortBy values without enforcing the sortable-column allow-list.
What information can an attacker obtain?
The attacker can determine the relative ordering of otherwise unexposed columns on the model, including columns reached through dotted related-model paths. Reversing asc and desc can confirm that the ordering reflects the hidden value; more targeted recovery may be possible when searchable or filterable columns and pagination are available.
What should be done if patching cannot happen immediately?
Restrict access to affected SQLAdmin list views, particularly for unauthenticated users, and avoid exposing models that contain sensitive fields or relationships. Hiding columns in the UI alone does not mitigate the issue.