FKIE_CVE-2026-54553

Vulnerability from fkie_nvd - Published: 2026-08-26 15:16 - Updated: 2026-08-26 16:16
Severity
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Summary
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.
References
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/pull/776
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/releases/tag/0.16.1
security-advisories@github.comhttps://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "starlette-admin",
          "vendor": "jowilf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.16.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1."
    }
  ],
  "id": "CVE-2026-54553",
  "lastModified": "2026-08-26T16:16:27.620",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54553",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T15:15:23.979363Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T15:16:49.370",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/pull/776"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.