Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for starlette-admin by jowilf

    CVE-2026-54553 (GCVE-0-2026-54553)

    Vulnerability from nvd – Published: 2026-08-26 14:13 – Updated: 2026-08-26 15:15
    VLAI
    Title
    Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
    Summary
    Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 15:15 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-248 - Uncaught Exception
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    References
    Impacted products
    Vendor Product Version
    jowilf starlette-admin Affected: < 0.16.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:15:23.979363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:15:35.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette-admin",
          "vendor": "jowilf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:13:33.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/pull/776",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/pull/776"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6753-gr46-6wpr",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54553",
    "datePublished": "2026-08-26T14:13:33.204Z",
    "dateReserved": "2026-06-15T19:04:14.456Z",
    "dateUpdated": "2026-08-26T15:15:35.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54553 (GCVE-0-2026-54553)

    Vulnerability from cvelistv5 – Published: 2026-08-26 14:13 – Updated: 2026-08-26 15:15
    VLAI
    Title
    Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
    Summary
    Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 15:15 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-248 - Uncaught Exception
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    References
    Impacted products
    Vendor Product Version
    jowilf starlette-admin Affected: < 0.16.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:15:23.979363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:15:35.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette-admin",
          "vendor": "jowilf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:13:33.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/pull/776",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/pull/776"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6753-gr46-6wpr",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54553",
    "datePublished": "2026-08-26T14:13:33.204Z",
    "dateReserved": "2026-06-15T19:04:14.456Z",
    "dateUpdated": "2026-08-26T15:15:35.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}