Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
ModelView.sortquery() uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattr(model, ...) and fed into relationship joins and orderby(), so a request can sort by any column of the model — including ones hidden from columnlist — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure ordering oracle. Root cause columnsortablelist is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it. Exploitation A single request leaks the relative ordering of an unexposed column; the asc↔desc reversal confirms rows are ordered by the secret's actual value. Pairing sortBy with searchable/filterable columns and pagination can narrow the oracle toward specific values,…
Recommended action: Upgrade to 0.27.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The ajaxlookup endpoint in application.py bypasses the isaccessible() access control check that all other endpoints enforce. If a developer restricts model access by overriding isaccessible(), an authenticated user can still query that model's data through the ajaxlookup endpoint — silently bypassing the restriction. Affected endpoint: GET /{identity}/ajax/lookup?name=<field&term=<query All other endpoints enforce both checks: | Endpoint | @loginrequired | isaccessible() | |---|---|---| | list | ✓ | ✓ | | create | ✓ | ✓ | | edit | ✓ | ✓ | | delete | ✓ | ✓ | | details | ✓ | ✓ | | export | ✓ | ✓ | | ajaxlookup (before fix) | ✗ | ✗ | | ajaxlookup (after fix) | ✓ | ✓ | Note: before this fix, ajaxlookup also lacked the @loginrequired decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users. Patches Two changes were made to ajaxlookup: 1. Replaced the hand-rolled authentication…
Recommended action: Upgrade to 0.25.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.