CVE-2026-54553: Validation Bypass in starlette-admin REST API via Unvalidated Sort and Filter Fields
Vulnerability ID: CVE-2026-54553
CVSS Score: 5.4
Published: 2026-08-26
A validation bypass vulnerability exists in starlette-admin versions prior to 0.16.1. The administrative REST list API fails to validate user-controlled query parameters against server-side schemas. This allows authenticated users to sort or filter data using fields marked as hidden, non-sortable, or non-searchable. This behavior leads to unauthorized information exposure via blind sorting and denial of service via uncaught database exceptions.
TL;DR
Unvalidated order_by and where query parameters in starlette-admin allow authenticated users to filter or sort data using restricted, hidden, or non-existent database columns, resulting in potential data disclosure and application denial of service.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-639 / CWE-200 / CWE-248
- Attack Vector: Network
- CVSS Severity: Medium (5.4)
- Exploit Status: Proof of Concept
- EPSS Score: Not Available
- KEV Status: Not Listed
Affected Systems
- Web applications using starlette-admin versions prior to 0.16.1
-
starlette-admin: < 0.16.1 (Fixed in:
0.16.1)
Code Analysis
Commit: 3d9639d
Fix validation for order_by parameter to avoid sorting by non-sortable fields
Commit: 57a1a76
Add strict where clause validation for searchable fields
Commit: af05b45
Implement recursive field extraction for complex search dictionaries
Commit: d2a25eb
Integrate API parameter validations inside the base controller
Exploit Details
- GitHub Security Advisory: Exploit PoC details and technical validation methods included in the vulnerability writeup.
Mitigation Strategies
- Upgrade the starlette-admin package to version 0.16.1 or later.
- Implement Web Application Firewall (WAF) rule sets to filter administrative API traffic containing complex nested query strings or dunder properties.
- Enforce strict access controls on administrative endpoints to limit access to trusted IP ranges.
Remediation Steps:
- Identify all deployments using starlette-admin.
- Modify requirements.txt, Pipfile, or pyproject.toml to specify starlette-admin>=0.16.1.
- Run pip install -r requirements.txt to apply the update.
- Verify that requests with unauthorized order_by parameters return HTTP 422 errors.
References
Read the full report for CVE-2026-54553 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)