4.3Mittel
CVE-2026-89267starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
Beschreibung
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
Schwachstellentyp (CWE):
CWE-863
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| encode | starlette | 0.16.1 – ≤ 0.17.1 | |
| jowilf | starlette-admin | 0.16.1 – ≤ 0.17.1 |
Referenzen und Patches
- Unenforced searchable_fields allowlist in _validate_where() at 0.17.1 technical-description
- https://github.com/jowilf/starlette-admin product
- VulnCheck Advisory: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass third-party-advisory