CVE-2026-54553

Name of the Vulnerable Software and Affected Versions Starlette-Admin versions prior to 0.16.1

Description An authenticated user with access to a list endpoint can bypass administrative interface restrictions by submitting arbitrary field names to the starlette admin/base.py and BaseModelView validation path. The list API fails to validate user-supplied order by and structured where field names against the configured sortable fields and searchable fields allowlists. This allows requests to sort or filter on fields not intended for these actions, leading to limited information exposure. Furthermore, providing invalid field names or special Python attribute names, such as metadata and the class dunder attribute, can trigger unhandled exceptions and HTTP 500 responses, resulting in a limited denial of service for targeted requests.

Recommendations Update to version 0.16.1.