CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.

• CWE-200
• CWE-248
• CWE-639

• https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3
• https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b
• https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3
• https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51
• https://github.com/jowilf/starlette-admin/pull/776
• https://github.com/jowilf/starlette-admin/releases/tag/0.16.1
• https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54548kas is a setup tool for bitbake based projects. Prior to 5.4…3.3
• CVE-2026-54549Meta Ads MCP is a Model Context Protocol (MCP) server that l…8.3
• CVE-2026-5455A vulnerability was determined in Dialogue App up to 4.3.2 o…3.3
• CVE-2026-54550IzPack is a widely used tool for packaging applications on t…7.4
• CVE-2026-54551WireGuard Portal, or wg-portal, is a web-based configuration…4.3
• CVE-2026-54552sh provides Python process launching. Prior to 2.2.4, the _u…7.9
• CVE-2026-54555rtk filters and compresses command outputs before they reach…7.8
• CVE-2026-54556Http4s is a Scala interface for HTTP services. Prior to 0.23…8.2
• CVE-2026-54557mise manages dev tools like node, python, cmake, and terrafo…5.5
• CVE-2026-54559PocketSphinx is a small speech recognizer. Prior to 5.1.1, t…6.9
• CVE-2026-5456A vulnerability was identified in Align Technology My Invisa…3.3
• CVE-2026-54560Cloudreve is a self-hosted file management and sharing syste…7.6