Piccolo Admin exposes session information through the GET /api/tables/sessions/ endpoint because the token column is treated as non‑secret. A user with administrator privileges who is not a superuser can exploit this endpoint to retrieve another user’s live session token, replay it as a cookie, and then permanently set the attacker’s own account to superuser status. The vulnerability leads to an elevation of privileges and is identified by Information Exposure (CWE‑200), Improper Privilege Management (CWE‑269), and Improper Permission Loss (CWE‑863).

The issue affects Piccolo Admin, a component of the piccolo‑orm ecosystem, in all releases before version 1.14.0. It is relevant in deployments that include custom Sessions and User tables in the create_admin configuration. No specific sub‑versions are listed.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the exact exploitation probability cannot be quantified, but the lack of a secret token means the attack is straightforward for anyone with administrative access. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is an authenticated internal attacker who holds administrative privileges but not superuser status, able to issue a GET request to the API endpoint and subsequently replay the captured session token with minimal effort.