EUVD-2026-77581
GHSA-ccg5-9c8w-xh6v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint, no auth required by default, ordering oracle yields partial confidentiality impact only, no write or availability effect.
Primary rating from Vendor (https://github.com/smithyhq/sqladmin).
CVSS VectorVendor: https://github.com/smithyhq/sqladmin
Lifecycle Timeline
2DescriptionCVE.org
Summary
ModelView.sort_query() uses the attacker-controlled sortBy list-view query parameter without checking it against the configured column_sortable_list allow-list. The value is resolved with getattr(model, ...) and fed into relationship joins and order_by(), so a request can sort by any column of the model - including ones hidden from column_list - and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure ordering oracle.
Root cause
column_sortable_list is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.
Exploitation
A single request leaks the relative ordering of an unexposed column; the asc↔desc reversal confirms rows are ordered by the secret's actual value. Pairing sortBy with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.
AnalysisAI
Unauthenticated remote attackers can exploit sqladmin's ModelView list view to probe hidden model column values via an ordering oracle, bypassing the UI-level column_sortable_list restriction. The sortBy HTTP query parameter is resolved through getattr(model, ...) and fed directly into ORM ORDER BY clauses without server-side validation, meaning any column - including those deliberately hidden from column_list - and related-model columns via dotted paths can be sorted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The sqladmin `ModelView` list endpoint must be reachable over the network by the attacker; if the interface is additionally protected by application-level authentication, exploitation requires valid credentials (the CVSS PR:N reflects the absence of built-in sqladmin auth gates, not any additional auth the operator may have added). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly captures the unauthenticated, low-complexity network vector with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade sqladmin to version 0.27.1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today