newpanjing simpleui Missing Authentication Vulnerability in AjaxAdmin AJAX Endpoint

A vulnerability exists in newpanjing simpleui version 2026.01.13, specifically within the AjaxAdmin component's AJAX endpoint. The issue arises in the self.get_action function of simpleui/admin.py, where authentication checks are bypassed. This vulnerability allows for remote exploitation, enabling unauthorized users to execute actions on admin models via POST requests. The problem has been publicly disclosed, but the project maintainers have not yet addressed it.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of admin actions, such as data modification, export, or destructive bulk operations, depending on the actions available in the targeted application.

Reproduction

To reproduce this vulnerability, register a model admin class that inherits from simpleui.admin.AjaxAdmin. Ensure that the admin class has actions registered that can be exploited, such as export or bulk update actions. An unauthorized user can then send a POST request to the '/admin/<app_label>/<model_name>/ajax' endpoint, including the '_action' parameter with the name of the registered action, along with '_selected' containing a list of selected item IDs.

Remediation

Wrap the custom AJAX views in 'self.admin_site.admin_view()' to restore proper authentication and authorization checks. Additionally, reject unsafe HTTP methods and maintain Django's default CSRF protection.