A critical privilege escalation vulnerability in Piccolo Admin allows authenticated users to gain full administrative control by exploiting exposed session tokens.

The application improperly exposes session tokens via the Sessions table, which is accessible to lower-privileged authenticated administrators. This allows an attacker to replay a stolen token to impersonate a superuser and escalate their own account privileges permanently.

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk to organizational security. Successful exploitation grants an attacker full control over the administrative interface, leading to complete compromise of the content management system, unauthorized data access, and potential manipulation of the underlying application infrastructure.

Immediate Action: Update the piccolo_admin package to version 1.14.0 or later and ensure the associated piccolo_api package is updated to version 1.10.0.

Proactive Monitoring: Review administrative access logs for unusual GET requests to the /api/tables/sessions/ endpoint, particularly those originating from non-superuser accounts.

Compensating Controls: Implement strict network access controls to limit access to the admin interface to known, trusted management IP addresses while the update is being staged.

Public Exploit Available: Unknown

Given the severity of potential privilege escalation, this update should be treated as a high-priority task. Organizations utilizing Piccolo Admin must verify their current version and apply the recommended patches immediately to prevent unauthorized administrative access and potential system-wide compromise.