4.3Medium
CVE-2026-89267starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
Description
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
Weakness (CWE):
CWE-863
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| encode | starlette | 0.16.1 – ≤ 0.17.1 | |
| jowilf | starlette-admin | 0.16.1 – ≤ 0.17.1 |
References and patches
- Unenforced searchable_fields allowlist in _validate_where() at 0.17.1 technical-description
- https://github.com/jowilf/starlette-admin product
- VulnCheck Advisory: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass third-party-advisory