THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-ccg5-9c8w-xh6v (medium) — SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

[GHSA] GHSA-ccg5-9c8w-xh6v (medium) — SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

medgithub_advisoriesPublished 2026-09-09

GHSA-ccg5-9c8w-xh6v Severity: medium CVE: CVE-2026-54529

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

## Summary

`ModelView.sort_query()` uses the attacker-controlled `sortBy` list-view query parameter without checking it against the configured `column_sortable_list` allow-list. The value is resolved with `getattr(model, ...)` and fed into relationship j

Indicators of compromise

Original source: https://github.com/advisories/GHSA-ccg5-9c8w-xh6v