CVE-2026-89267

MEDIUMCVSS 4.3

Description

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

Timeline

Published:September 12th, 2026 2:16 AM

Last modified:September 12th, 2026 2:16 AM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/jowilf/starlette-admin
https://github.com/jowilf/starlette-admin/blob/0.17.1/starlette_admin/views.py#L971-L987
https://www.vulncheck.com/advisories/starlette-admin-0.16.1-through-0.17.1-searchable-fields-allowlist-bypass

Source: NIST NVD · Data may lag official sources by up to one minute