EUVD-2026-45421
GHSA-xm67-c694-6hwc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no authentication required (PR:N), no user interaction; no scope change; individual C/I/A impacts bounded to Low per CVSS 4.0 source data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the self.get_action function in simpleui/admin.py. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.
Technical ContextAI
simpleui is a third-party Django admin interface enhancement library (CPE: cpe:2.3:a:newpanjing:simpleui:*:*:*:*:*:*:*:*) that extends the default Django admin with additional UI components including an AjaxAdmin AJAX endpoint. The root cause is CWE-306 (Missing Authentication for Critical Function): the self.get_action method in simpleui/admin.py handles AJAX-triggered admin actions without enforcing Django's standard authentication and permission checks that normally gate access to admin views. Django admin actions are intended to operate only on behalf of authenticated superusers or staff; the missing guard on this endpoint breaks that invariant, exposing administrative operation invocation to any network-reachable caller.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was notified via GitHub issue #537 (https://github.com/newpanjing/simpleui/issues/537) but has not responded. Monitor the repository at https://github.com/newpanjing/simpleui/ for any fix release. As immediate compensating controls: restrict access to the Django admin path (typically /admin/) at the web server or network perimeter level to trusted IP ranges only, which eliminates the remote attack vector at the cost of restricting legitimate remote admin access. Alternatively, configure a reverse proxy (nginx, Apache) to require HTTP Basic Authentication as a pre-authentication layer in front of the admin path - this adds auth overhead but preserves access. If the AjaxAdmin AJAX functionality is not business-critical, consider temporarily removing or monkey-patching the simpleui package to disable the get_action endpoint until a patched version is available. Do not expose the Django admin interface directly to the public internet regardless of this specific vulnerability.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today