Information disclosure in jowilf starlette-admin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Denial of service, Security bypass
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200, CWE-248 and CWE-639.
Summary
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jowilf | starlette-admin | before 0.16.1 | 0.16.1 | Patch available | CNA |
| — | starlette-admin (PyPI) | before 0.16.1 | 0.16.1 | Patch available | GHSA-6753-gr46-6wpr |
- starlette-admin Vendorjowilf Affected before 0.16.1 Fixed in 0.16.1 Patch available CNA
- starlette-admin (PyPI) Vendor— Affected before 0.16.1 Fixed in 0.16.1 Patch available GHSA-6753-gr46-6wpr
Remediation
- Fix · CNA starlette-admin (jowilf) Fixed in 0.16.1
- Fix · GHSA-6753-gr46-6wpr starlette-admin (PyPI) Fixed in 0.16.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54553
- 2026-10-03 Alias added: GHSA-6753-gr46-6wpr
References
Other 8
- https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr
- https://github.com/jowilf/starlette-admin/pull/776
- https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3
- https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b
- https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3
- https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51
- https://github.com/jowilf/starlette-admin/releases/tag/0.16.1
- https://github.com/jowilf/starlette-admin
More jowilf vulnerabilities
- TI-2026-60441 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-54553 · CVE Program
- CVE-2026-54553 · NVD
- FIRST EPSS
- GHSA-6753-gr46-6wpr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences