fastapiadmin

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

fastapiadmin records in CISA KEV

No fastapiadmin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fastapiadmin 5 records HIGH

Records

7 records

TI-2026-75428 CVE-2026-111642 · GHSA-p7cm-h8w6-p4cm

Hard-coded JWT secret in FastapiAdmin allows privilege escalation

HIGH 73

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0036 Published 2026-10-16 No fix listed CWE-321

TI-2026-02567 CVE-2026-2975 · GHSA-h4v7-f6v2-4hmm

FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure

HIGH 70

A security flaw has been discovered in FastApiAdmin up to 2.2.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00479 Published 2026-02-23 No fix listed CWE-200

TI-2026-02571 CVE-2026-2979 · GHSA-m879-6gvr-239v

FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload

MEDIUM 57

A flaw has been found in FastApiAdmin up to 2.2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00341 Published 2026-02-23 No fix listed CWE-284

TI-2026-02570 CVE-2026-2978 · GHSA-qmq9-8xrr-rx63

FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload

MEDIUM 57

A vulnerability was detected in FastApiAdmin up to 2.2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00389 Published 2026-02-23 No fix listed CWE-284

TI-2026-02569 CVE-2026-2977 · GHSA-rgpr-47mq-rh3c

FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload

MEDIUM 57

A security vulnerability has been detected in FastApiAdmin up to 2.2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0034 Published 2026-02-23 No fix listed CWE-284

TI-2026-02568 CVE-2026-2976 · GHSA-p2cq-gh8c-83cc

FastApiAdmin Download Endpoint controller.py download_controller information disclosure

MEDIUM 57

A weakness has been identified in FastApiAdmin up to 2.2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-02-23 No fix listed CWE-200

TI-2026-75427 CVE-2026-111641 · GHSA-xj6f-6mc4-xhqp

Authentication bypass in FastapiAdmin via auto-login endpoints

MEDIUM 48

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00433 Published 2026-10-16 No fix listed CWE-306

Open these records in search →

Critical	1
High	1
Medium	5
Low	0
No CVSS	0