CVE-2026-54553: Starlette-Admin Information Disclosure Flaw

CVE-2026-54553 Overview

CVE-2026-54553 affects Starlette-Admin, an administrative interface framework for FastAPI and Starlette applications. Versions prior to 0.16.1 fail to validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user can submit arbitrary field names to the list API, bypassing restrictions enforced by the administrative user interface. This allows sorting or filtering on fields that are not intended to be exposed, causing limited information disclosure [CWE-200]. Invalid or special Python attribute names such as metadata and class dunder attributes can also trigger unhandled exceptions and HTTP 500 responses.

Critical Impact
Authenticated attackers can enumerate non-public fields and induce denial of service against list endpoints in Starlette-Admin deployments running versions prior to 0.16.1.

Affected Products

Starlette-Admin versions prior to 0.16.1
FastAPI applications embedding vulnerable Starlette-Admin releases
Starlette applications embedding vulnerable Starlette-Admin releases

Discovery Timeline

2026-08-26 - CVE-2026-54553 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54553

Vulnerability Analysis

The flaw resides in starlette_admin/base.py and the BaseModelView validation path. The list API accepts order_by and structured where parameters directly from client requests. It does not check whether the supplied field names appear in the sortable_fields and searchable_fields allowlists declared on the view. As a result, the administrative UI restricts which fields are exposed as sortable or searchable, while the underlying API accepts any attribute name the ORM resolves. This exposes fields that developers assumed were hidden from clients.

Root Cause

The root cause is missing server-side authorization on query parameters. The framework treats the presence of a field in sortable_fields or searchable_fields as a UI concern rather than a security boundary. The backend passes attacker-controlled field identifiers to the ORM query builder without normalization against the configured allowlists.

Attack Vector

An authenticated user with access to any list endpoint crafts an HTTP request that sets order_by or the structured where payload to a field name outside the allowlist. The server executes the ordered or filtered query and returns results that reflect the value of the non-public field. Supplying reserved Python attribute names such as metadata or class dunder attributes such as __class__ triggers unhandled exceptions inside the ORM adapter. This produces HTTP 500 responses and denial of service for the affected request.

No synthetic exploit code is provided. Refer to the GitHub Security Advisory GHSA-6753-gr46-6wpr for the vendor's technical description.

Detection Methods for CVE-2026-54553

Indicators of Compromise

List API requests containing order_by or where field names that are not declared in the target view's sortable_fields or searchable_fields.
HTTP 500 responses from Starlette-Admin list endpoints correlated with order_by=metadata, order_by=__class__, or similar dunder attribute values.
Unusual sort or filter parameter enumeration from authenticated administrative sessions.

Detection Strategies

Compare incoming order_by and where field names against the declared allowlist for each view and alert on mismatches.
Track error rates on Starlette-Admin list endpoints and flag spikes tied to specific authenticated principals.
Log full query string parameters at the reverse proxy or WAF layer for post-hoc analysis of field enumeration attempts.

Monitoring Recommendations

Enable structured request logging on all starlette_admin routes, capturing user identity, query parameters, and response codes.
Alert on repeated HTTP 500 responses from the same session against admin list endpoints within a short window.
Review authenticated administrative user access to ensure the principle of least privilege is enforced for accounts that reach list endpoints.

How to Mitigate CVE-2026-54553

Immediate Actions Required

Upgrade Starlette-Admin to version 0.16.1 or later, which enforces allowlist validation on order_by and where parameters.
Audit all BaseModelView subclasses to confirm that sortable_fields and searchable_fields declare only fields intended for client exposure.
Rotate credentials for any administrative account whose session may have exercised out-of-allowlist queries against sensitive fields.

Patch Information

The fix is included in the Starlette-Admin 0.16.1 release. The change was delivered through pull request #776 and associated commits 3d9639d1, 57a1a76d, af05b45c, and d2a25ebb. The patch adds server-side validation that rejects field names outside the configured allowlists before they reach the ORM layer.

The following excerpt from the security patch shows related dependency and lifecycle hardening applied alongside the validation fix:

python

         )
     ],
     on_startup=[lambda: connect("example")],
-    on_shutdown=[lambda: disconnect()],
+    on_shutdown=[disconnect],
 )
 
 # Create admin

Source: GitHub Commit 3d9639d1

Workarounds

Place a reverse proxy or WAF rule in front of Starlette-Admin that denies order_by and where field names not present in an explicit allowlist per route.
Restrict access to administrative list endpoints to a small set of trusted authenticated users until the upgrade is applied.
Disable or remove admin views that expose models containing sensitive fields not required for operations.

bash

# Configuration example
pip install --upgrade "starlette-admin>=0.16.1"