Pypi · Starlette-Admin · CVE-2026-54553
**Name of the Vulnerable Software and Affected Versions**
Starlette-Admin versions prior to 0.16.1
**Description**
An authenticated user with access to a list endpoint can bypass administrative interface restrictions by submitting arbitrary field names to the `starlette admin/base.py` and `BaseModelView` validation path. The list API fails to validate user-supplied `order by` and structured `where` field names against the configured `sortable fields` and `searchable fields` allowlists. This allows requests to sort or filter on fields not intended for these actions, leading to limited information exposure. Furthermore, providing invalid field names or special Python attribute names, such as `metadata` and the class dunder attribute, can trigger unhandled exceptions and HTTP 500 responses, resulting in a limited denial of service for targeted requests.
**Recommendations**
Update to version 0.16.1.