Privilege Escalation in Piccolo Admin via Session Token Exposure

The piccolo_admin package (up to and including version 1.13.0) contains a significant authorization vulnerability due to a flawed implementation of the superuser_validators helper function. This function utilizes a deny-list approach for protecting sensitive resources, restricting only PUT, PATCH, DELETE, and POST methods, while failing to block GET requests. Simultaneously, the SessionsBase.token field in the piccolo_api session authentication module is not marked as secret=True, resulting in the exposure of live session tokens in plaintext within GET /api/tables/sessions/ responses. An attacker with standard (non-superuser) admin credentials can retrieve the session token for a superuser, replay that token to impersonate them, and subsequently modify their own user record to grant themselves permanent superuser privileges. This vulnerability, tracked as CVE-2026-55485, affects deployments that explicitly expose the Sessions table in the admin configuration, a pattern often used for session monitoring and management.

Attack Chain

1. The attacker authenticates as a standard, non-superuser administrator (e.g., admin=True, superuser=False).
2. The attacker identifies that the Sessions table is exposed in the admin dashboard.
3. The attacker issues a GET request to /api/tables/sessions/ to retrieve the entire contents of the sessions table.
4. The server returns a 200 OK response containing plaintext session tokens for all active users, including superusers.
5. The attacker extracts a superuser's session token from the JSON response.
6. The attacker uses the stolen superuser token in a new session cookie (Cookie: id=...) to authenticate requests to the admin API.
7. The attacker sends a PATCH request to /api/tables/piccolo_user/<attacker_id>/ with the payload {"superuser": true}.
8. The server processes the request as the superuser, successfully promoting the attacker's account to superuser status.

Impact

Successful exploitation results in full administrative takeover. An attacker can access all tables, modify user credentials, revoke existing sessions, and potentially plant payloads in exported data. The elevation is permanent, as the attacker effectively modifies the database record associated with their account.

Recommendation

• Upgrade piccolo_admin and associated piccolo_api components immediately; identify the specific patched version from the vendor and apply it.
• Apply the recommended fix to superuser_validators by implementing an allow-list or a more restrictive if not request.user.user.superuser: raise HTTPException pattern to block all unauthorized access.
• Apply the defense-in-depth fix by setting secret=True on SessionsBase.token in piccolo_api/session_auth/tables.py to prevent plaintext leakage.
• Monitor web logs for GET requests to /api/tables/sessions/ originated by users without superuser status.