Vulnerability-Lookup

CVE-2026-54553 (GCVE-0-2026-54553)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:13 – Updated: 2026-08-26 15:15

Title

Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:15 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-248 - Uncaught Exception
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/jowilf/starlette-admin/securit…	x_refsource_CONFIRM
https://github.com/jowilf/starlette-admin/pull/776	x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/…	x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/…	x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/…	x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/…	x_refsource_MISC
https://github.com/jowilf/starlette-admin/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jowilf	starlette-admin	Affected: < 0.16.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:15:23.979363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:15:35.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette-admin",
          "vendor": "jowilf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:13:33.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/pull/776",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/pull/776"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
        },
        {
          "name": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6753-gr46-6wpr",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54553",
    "datePublished": "2026-08-26T14:13:33.204Z",
    "dateReserved": "2026-06-15T19:04:14.456Z",
    "dateUpdated": "2026-08-26T15:15:35.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54553",
      "date": "2026-08-30",
      "epss": "0.00336",
      "percentile": "0.26254"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54553\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-26T15:16:49.370\",\"lastModified\":\"2026-08-26T16:16:27.620\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jowilf\",\"product\":\"starlette-admin\",\"versions\":[{\"version\":\"\u003c 0.16.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T15:15:23.979363Z\",\"id\":\"CVE-2026-54553\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-248\"},{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/pull/776\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/releases/tag/0.16.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54553\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T15:15:23.979363Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T15:15:27.426Z\"}}], \"cna\": {\"title\": \"Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS\", \"source\": {\"advisory\": \"GHSA-6753-gr46-6wpr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"jowilf\", \"product\": \"starlette-admin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.16.1\"}]}], \"references\": [{\"url\": \"https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr\", \"name\": \"https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/pull/776\", \"name\": \"https://github.com/jowilf/starlette-admin/pull/776\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3\", \"name\": \"https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b\", \"name\": \"https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3\", \"name\": \"https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51\", \"name\": \"https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jowilf/starlette-admin/releases/tag/0.16.1\", \"name\": \"https://github.com/jowilf/starlette-admin/releases/tag/0.16.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T14:13:33.204Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54553\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T15:15:35.305Z\", \"dateReserved\": \"2026-06-15T19:04:14.456Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T14:13:33.204Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54553

Vulnerability from fkie_nvd - Published: 2026-08-26 15:16 - Updated: 2026-08-26 16:16

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/pull/776
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/releases/tag/0.16.1
	security-advisories@github.com	https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "starlette-admin",
          "vendor": "jowilf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1."
    }
  ],
  "id": "CVE-2026-54553",
  "lastModified": "2026-08-26T16:16:27.620",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54553",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T15:15:23.979363Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T15:16:49.370",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/pull/776"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6753-GR46-6WPR

Vulnerability from github – Published: 2026-08-26 14:14 – Updated: 2026-08-26 14:14

Summary

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Details

Summary

Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.

An authenticated user can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable. Additionally, supplying invalid field names or special Python attribute names can trigger unhandled exceptions that result in HTTP 500 responses.

Impact

An authenticated user with access to affected list endpoints may:

Bypass intended UI restrictions and perform sorting or filtering on fields that are not configured as searchable or sortable.
Cause affected API requests to fail with HTTP 500 responses by supplying invalid field names or special Python attribute names such as metadata or __class__.

This vulnerability may result in unauthorized use of query functionality and limited denial-of-service conditions affecting the targeted endpoint.

Affected Versions

All versions before 0.16.1.

Patched Versions

0.16.1

Workarounds

There are no known workarounds. Users should upgrade to version 0.16.1 or later.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.16.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "starlette-admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54553"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-248",
      "CWE-602",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:14:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAffected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.\n\nAn authenticated user can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable. Additionally, supplying invalid field names or special Python attribute names can trigger unhandled exceptions that result in HTTP 500 responses.\n\n## Impact\n\nAn authenticated user with access to affected list endpoints may:\n\n* Bypass intended UI restrictions and perform sorting or filtering on fields that are not configured as searchable or sortable.\n* Cause affected API requests to fail with HTTP 500 responses by supplying invalid field names or special Python attribute names such as `metadata` or `__class__`.\n\nThis vulnerability may result in unauthorized use of query functionality and limited denial-of-service conditions affecting the targeted endpoint.\n\n## Affected Versions\n\nAll versions before 0.16.1.\n\n## Patched Versions\n\n* 0.16.1\n\n## Workarounds\n\nThere are no known workarounds. Users should upgrade to version 0.16.1 or later.",
  "id": "GHSA-6753-gr46-6wpr",
  "modified": "2026-08-26T14:14:37Z",
  "published": "2026-08-26T14:14:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/pull/776"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jowilf/starlette-admin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Starlette-Admin\u0027s unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54553 (GCVE-0-2026-54553)

FKIE_CVE-2026-54553

GHSA-6753-GR46-6WPR

Summary

Impact

Affected Versions

Patched Versions

Workarounds

Tags

Sightings

Nomenclature