Multiple security vulnerabilities have been identified in AdminNeo, a web-based database administration tool. The flaws affect version-cache handling, cross-site request forgery protection, SQLite query controls, database server version rendering, and cookie header generation. Affected versions include 4.6.0 through at least 5.5.0 and, for several issues, versions below 5.5.1. The overall risk is high because they can enable denial of service, cross-site request forgery, cross-site scripting, cookie theft, arbitrary file deletion, and remote code execution.
CVE-2026-59978 (CVSS 7.5 — High): An unauthenticated attacker can send an array value to the version-cache endpoint. The resulting type error causes server errors for all users for up to a day.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in AdminNeo, a web-based database administration tool. The flaws affect version-cache handling, cross-site request forgery protection, SQLite query controls, database server version rendering, and cookie header generation. Affected versions include 4.6.0 through at least 5.5.0 and, for several issues, versions below 5.5.1. The overall risk is high because they can enable denial of service, cross-site request forgery, cross-site scripting, cookie theft, arbitrary file deletion, and remote code execution.
CVE-2026-59978 (CVSS 7.5 — High): An unauthenticated attacker can send an array value to the version-cache endpoint. The resulting type error causes server errors for all users for up to a day.[emaillocker id="1283"]
CVE-2026-96629 (CVSS 6.8 — Medium): The cross-site request forgery token design exposes enough information for an observer to recover the session secret and forge valid tokens. Low entropy also permits blind brute-force attempts against the token.
CVE-2026-96630 (CVSS 7.2 — High): An authenticated SQLite user can bypass the query blocklist by using a database export command. This can write attacker-controlled content to a web-accessible location and lead to code execution.
CVE-2026-96632 (CVSS 8.2 — High): A malicious database server can return a crafted version string that is rendered inside a nonce-protected script. This allows script execution without authentication when combined with login cross-site request forgery.
CVE-2026-96631 (CVSS 8.2 — High): An attacker who can influence the forwarded-prefix header can inject cookie attributes into response headers. This can expand session and key cookies to an attacker-controlled domain.
CVE-2026-96633 (CVSS 8.1 — High): An attacker with access to the SQLite database-list drop feature can delete arbitrary files. The flaw affects the SQLite database management interface.
CVE-2026-96634 (CVSS 6.9 — Medium): An incorrect check of a function return value in SQLite multi-query handling can allow remote code execution. An attacker who can influence SQLite query execution may exploit the flaw.
These vulnerabilities collectively present a severe risk to exposed AdminNeo deployments, particularly those reachable by untrusted users or database servers. The most at risk are instances that allow unauthenticated access, accept forwarded headers from untrusted proxies, or connect to untrusted database servers. Affected deployments should be treated as high-priority security incidents.
The following reports contain further technical details: