CVE-2026-54553

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54553
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54553.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54553
Aliases
Published
2026-08-26T14:13:33Z
Modified
2026-09-11T03:30:14Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Details

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-248",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54553.json"
}
References

Affected packages

Git / github.com/jowilf/starlette-admin

Affected ranges

Type
GIT
Repo
https://github.com/jowilf/starlette-admin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d9639d12ffc30b0b92d45ad6aae5fefabc948f3
Fixed
57a1a76d45dfed16f580677303c5fd25220bd36b
Fixed
af05b45cd90944b726949fd650ab9d19f1abafc3
Fixed
d2a25ebbaf213d4c2cfc87187e34309ca6e30a51
Fixed
e5afc9a6e8afe71880452be3ffc1fcc8bf036211
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.16.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.2.pre
0.1.0
0.1.1
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.12.2
0.13.0
0.13.0-rc1
0.13.0-rc2
0.13.1
0.13.2
0.14.0
0.14.1
0.15.0
0.15.0rc8
0.15.0rc9
0.15.1
0.15.rc0
0.15.rc1
0.15.rc2
0.15.rc3
0.15.rc4
0.15.rc7
0.16.0
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.5.0
0.5.1
0.5.2
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.9.0
v0.*
v0.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54553.json"