CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76772

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

chowda (>=0.0.0, <=0.8.0), nova-admin (1.0.0) +11 more potentially affected by CVE-2026-89267 via starlette-admin (>=0.16.1, <=0.17.1)

starlette-admin PYPI version =0.16.1, =0.0.0, =0.4.6a1, =0.1.0a1, =0.2.0, =0.0.1, =0.1.6, =1.0.0, =0.0.9, =10.0.11, =10.0.28 Source cves: CVE-2026-89267 Source advisory: MEND:CVE-2026-89267...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when it is configured as an empty list. As a result, authenticated users can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on columns ...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267: Incorrect Authorization

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

PT-2026-90553

Name of the Vulnerable Software and Affected Versions starlette-admin versions 0.16.1 through 0.17.1 Description Authenticated users can bypass the searchable fields allowlist when it is configured as an empty list. This allows the submission of structured filter queries through the where paramet...

llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)

starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: OSV:PYSEC-2026-3924...

PYSEC-2026-3924 Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

SummaryAffected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)

starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: OSV:GHSA-6753-GR46-6WPR...

llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)

starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: GHSA-6753-GR46-6WPR...

GHSA-6753-GR46-6WPR Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)

starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: MEND:CVE-2026-54553...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...