Cpe:2.3:a:piccolo_admin:piccolo_admin:*:*:*:*:*:*:*:*

An improper access control implementation in the piccolo_admin /api/tables/sessions/ endpoint allows authenticated non-superuser admins to leak plaintext session tokens and perform privilege escalation to superuser status via CVE-2026-55485.