Product
An improper access control implementation in the piccolo_admin /api/tables/sessions/ endpoint allows authenticated non-superuser admins to leak plaintext session tokens and perform privilege escalation to superuser status via CVE-2026-55485.