{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apiccolo_adminpiccolo_admin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:piccolo_admin:piccolo_admin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-55485"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["piccolo_admin (\u003c= 1.13.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Piccolo"],"content_html":"\u003cp\u003eThe piccolo_admin package (up to and including version 1.13.0) contains a significant authorization vulnerability due to a flawed implementation of the \u003ccode\u003esuperuser_validators\u003c/code\u003e helper function. This function utilizes a deny-list approach for protecting sensitive resources, restricting only \u003ccode\u003ePUT\u003c/code\u003e, \u003ccode\u003ePATCH\u003c/code\u003e, \u003ccode\u003eDELETE\u003c/code\u003e, and \u003ccode\u003ePOST\u003c/code\u003e methods, while failing to block \u003ccode\u003eGET\u003c/code\u003e requests. Simultaneously, the \u003ccode\u003eSessionsBase.token\u003c/code\u003e field in the \u003ccode\u003epiccolo_api\u003c/code\u003e session authentication module is not marked as \u003ccode\u003esecret=True\u003c/code\u003e, resulting in the exposure of live session tokens in plaintext within \u003ccode\u003eGET /api/tables/sessions/\u003c/code\u003e responses. An attacker with standard (non-superuser) admin credentials can retrieve the session token for a superuser, replay that token to impersonate them, and subsequently modify their own user record to grant themselves permanent superuser privileges. This vulnerability, tracked as CVE-2026-55485, affects deployments that explicitly expose the \u003ccode\u003eSessions\u003c/code\u003e table in the admin configuration, a pattern often used for session monitoring and management.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker authenticates as a standard, non-superuser administrator (e.g., \u003ccode\u003eadmin=True\u003c/code\u003e, \u003ccode\u003esuperuser=False\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker identifies that the \u003ccode\u003eSessions\u003c/code\u003e table is exposed in the admin dashboard.\u003c/li\u003e\n\u003cli\u003eThe attacker issues a \u003ccode\u003eGET\u003c/code\u003e request to \u003ccode\u003e/api/tables/sessions/\u003c/code\u003e to retrieve the entire contents of the sessions table.\u003c/li\u003e\n\u003cli\u003eThe server returns a 200 OK response containing plaintext session tokens for all active users, including superusers.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts a superuser's session token from the JSON response.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the stolen superuser token in a new session cookie (\u003ccode\u003eCookie: id=...\u003c/code\u003e) to authenticate requests to the admin API.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u003ccode\u003ePATCH\u003c/code\u003e request to \u003ccode\u003e/api/tables/piccolo_user/\u0026lt;attacker_id\u0026gt;/\u003c/code\u003e with the payload \u003ccode\u003e{\u0026quot;superuser\u0026quot;: true}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server processes the request as the superuser, successfully promoting the attacker's account to superuser status.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover. An attacker can access all tables, modify user credentials, revoke existing sessions, and potentially plant payloads in exported data. The elevation is permanent, as the attacker effectively modifies the database record associated with their account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade piccolo_admin and associated piccolo_api components immediately; identify the specific patched version from the vendor and apply it.\u003c/li\u003e\n\u003cli\u003eApply the recommended fix to \u003ccode\u003esuperuser_validators\u003c/code\u003e by implementing an allow-list or a more restrictive \u003ccode\u003eif not request.user.user.superuser: raise HTTPException\u003c/code\u003e pattern to block all unauthorized access.\u003c/li\u003e\n\u003cli\u003eApply the defense-in-depth fix by setting \u003ccode\u003esecret=True\u003c/code\u003e on \u003ccode\u003eSessionsBase.token\u003c/code\u003e in \u003ccode\u003epiccolo_api/session_auth/tables.py\u003c/code\u003e to prevent plaintext leakage.\u003c/li\u003e\n\u003cli\u003eMonitor web logs for \u003ccode\u003eGET\u003c/code\u003e requests to \u003ccode\u003e/api/tables/sessions/\u003c/code\u003e originated by users without \u003ccode\u003esuperuser\u003c/code\u003e status.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-28T21:17:17Z","date_published":"2026-08-28T21:17:17Z","id":"https://feed.craftedsignal.io/briefs/2026-08-piccolo-admin-privesc/","summary":"An improper access control implementation in the piccolo_admin /api/tables/sessions/ endpoint allows authenticated non-superuser admins to leak plaintext session tokens and perform privilege escalation to superuser status via CVE-2026-55485.","title":"Privilege Escalation in Piccolo Admin via Session Token Exposure","url":"https://feed.craftedsignal.io/briefs/2026-08-piccolo-admin-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:piccolo_admin:piccolo_admin:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}