MEDIUM 5.3 GitHub
CVE-2026-54529
SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
## Summary
`ModelView.sort_query()` uses the attacker-controlled `sortBy` list-view query parameter without checking it against the configured `column_sortable_list` allow-list. The value is resolved with `getattr(model, ...)` and fed into relationship joins and `order_by()`, so a request can sort by **any** column of the model — including ones hidden from `column_list` — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this
Affected Products
- pip/sqladmin < 0.27.1
References
- https://github.com/advisories/GHSA-ccg5-9c8w-xh6v
- https://github.com/smithyhq/sqladmin/security/advisories/GHSA-ccg5-9c8w-xh6v
- https://github.com/smithyhq/sqladmin/releases/tag/0.27.1
- https://github.com/advisories/GHSA-ccg5-9c8w-xh6v
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-09 via GitHub. Affected: pip/sqladmin < 0.27.1.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.