THREAT OPS › Threat News › [GHSA] GHSA-2gh4-jmwq-rr8w (high) — piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
[GHSA] GHSA-2gh4-jmwq-rr8w (high) — piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
GHSA-2gh4-jmwq-rr8w Severity: high CVE: CVE-2026-55485
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
## Summary
`piccolo_admin` uses a helper called `superuser_validators` to gate access to the user and session tables for non-superusers. The helper rejects `PUT`, `PATCH`, `DELETE`, and `POST`, but **does not reject
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-55485cve
Original source: https://github.com/advisories/GHSA-2gh4-jmwq-rr8w