CVE-2026-2975: FastAPI Admin Information Disclosure Flaw

CVE-2026-2975 Overview

A security flaw has been discovered in FastAPI-Admin up to version 2.2.0. This vulnerability affects the function reset_api_docs within the file /backend/app/plugin/init_app.py of the Custom Documentation Endpoint component. The manipulation of this function results in information disclosure, allowing attackers to potentially access sensitive application data. The attack can be performed remotely without authentication, and exploit code has been publicly released.

Critical Impact

Remote attackers can exploit this information disclosure vulnerability to access sensitive documentation and internal application details through the Custom Documentation Endpoint without authentication.

Affected Products

• FastAPI-Admin version 2.0
• FastAPI-Admin version 2.1
• FastAPI-Admin version 2.2.0

Discovery Timeline

• February 23, 2026 - CVE-2026-2975 published to NVD
• February 24, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2975

Vulnerability Analysis

This vulnerability is classified as an Information Disclosure issue (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in the reset_api_docs function within the Custom Documentation Endpoint component of FastAPI-Admin.

The vulnerability allows remote attackers to access sensitive information through the documentation endpoint without proper authorization checks. Since FastAPI-Admin is commonly used as an administrative backend for FastAPI applications, exposure of API documentation could reveal sensitive endpoint structures, authentication mechanisms, and internal application logic to unauthorized parties.

The attack requires no authentication or special privileges, and can be executed remotely over the network. While the vulnerability does not allow data modification or denial of service, the information exposed could be leveraged for further attacks against the application.

Root Cause

The root cause of this vulnerability lies in improper access control implementation within the reset_api_docs function located in /backend/app/plugin/init_app.py. The Custom Documentation Endpoint fails to properly validate user authorization before exposing API documentation content, allowing unauthenticated access to potentially sensitive internal documentation.

Attack Vector

The attack vector for CVE-2026-2975 is network-based, requiring no prior authentication or user interaction. An attacker can remotely access the vulnerable documentation endpoint to retrieve sensitive information about the application's API structure and configuration.

The exploitation process involves sending requests to the Custom Documentation Endpoint where the reset_api_docs function processes the request without adequate authorization validation, subsequently disclosing internal API documentation to the attacker.

For detailed technical information regarding the exploitation methodology, refer to the GitHub Vulnerability PoC published by the security researcher.

Detection Methods for CVE-2026-2975

Indicators of Compromise

• Unexpected or unauthorized access attempts to API documentation endpoints
• Unusual HTTP request patterns targeting /backend/app/plugin/ paths
• Anomalous traffic from external IP addresses accessing documentation endpoints
• Log entries showing unauthenticated access to custom documentation routes

Detection Strategies

• Monitor web server access logs for requests to the Custom Documentation Endpoint from unauthorized sources
• Implement alerting for repeated access attempts to documentation paths from unknown IP addresses
• Deploy web application firewall (WAF) rules to detect and block suspicious documentation endpoint access patterns
• Review authentication logs for anomalies around the reset_api_docs functionality

Monitoring Recommendations

• Enable detailed logging for all API documentation endpoint access
• Configure SIEM rules to alert on unauthorized documentation retrieval attempts
• Implement network monitoring for outbound data that may indicate successful information exfiltration
• Regularly audit access logs for the /backend/app/plugin/init_app.py functionality

How to Mitigate CVE-2026-2975

Immediate Actions Required

• Restrict access to the Custom Documentation Endpoint through network controls or web server configuration
• Implement authentication requirements for all documentation endpoints
• Disable or remove the custom documentation functionality if not required in production environments
• Review and audit current access logs for signs of prior exploitation

Patch Information

At the time of this advisory, no official patch has been released by the vendor. Organizations using FastAPI-Admin versions 2.0, 2.1, or 2.2.0 should implement the workarounds described below and monitor for vendor security updates. Additional vulnerability details are available at VulDB #347359.

Workarounds

• Implement authentication middleware to protect the Custom Documentation Endpoint
• Configure network-level access controls to restrict documentation endpoint access to trusted IP addresses only
• Disable the reset_api_docs functionality in production deployments
• Deploy a reverse proxy with authentication in front of the FastAPI-Admin application

# Example: Restrict documentation endpoint access via nginx
location /docs {
    allow 10.0.0.0/8;     # Allow internal network
    allow 192.168.0.0/16; # Allow private network
    deny all;              # Deny all other access
    
    # Require basic authentication
    auth_basic "Restricted Documentation";
    auth_basic_user_file /etc/nginx/.htpasswd;
}